realdavidops
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @08:44PM (#22873189)
We schedule a downtime window during upgrade, but typically see no frontend impact to the core service, SSO for end users. We snapshot the DB for rollback if needed as the migrations are not reversible.
Our actual DB size is pretty small so these are very non-intensive tasks.
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @06:19PM (#22872182)
The best part is when you start chaining Keycloak instances together. We've had a couple cases where customers have wanted their own identity management, so we use an instance of Keycloak to connect to our central keycloak instances and to their solution of choice (Google, AzureAD, etc), and allows everyone to use their preferred identity platform.
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @06:13PM (#22872131)
Hmm. I'm not sure what you mean. Users by default can use the console to update their 2FA credentials. The only time I have to intervene is when they lose their 2FA as it doesn't really do backup codes. We do require 2FA as a part of our login flows so this is something we're using heavily.
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @06:10PM (#22872108)
The biggest thing we encountered was related actually to our initial deployment with active directory. This made logins slow, but actually found we could remove the requirement for Active Directory.
It is super heavily based on Wildfly, and if you're not using a tool like docker, it can be kind-of a burden. It runs decently well in standalone mode, but we ended up using the docker container's clustering with Kubernetes service discovery helping to find the other nodes to achieve a clustered deployment.
Outside of that is has been extremely stable, we use Kubernetes deployment mechanism along with a correctly defined readiness check to allow us to seamlessly upgrade, and we've gone from 4.3.0.Final to 7.0.1 in production without any problems. We haven't upgraded to 8 or 9 yet as we're actually working on some new frontend UI changes we wanted to get out the door with the release.
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @06:04PM (#22872059)
Oof! Good catch! Yes Red Hat SSO
Re:Keycloak: Open-source identity and access management
on Tuesday April 14, 2020 @05:19PM (#22871583)
We've been using Keylocak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective.
Keycloak is the upstream project of Red Hat SSO (edit: correct name, thanks snuxoll.)
Running in Kubernetes with RDS Postgres in AWS.
Setting Up Slack SAML SSO with Keycloak
Re:Ask HN: What are the best government (.gov) designed websites?
on Tuesday March 27, 2018 @11:14PM (#16694957)
https://earthquake.usgs.gov/earthquakes/map/
Quickly displays important data.