Hacker News Reader

Comment by arinlen | Hacker News Reader

> Regarding Keycloak, it is a great project with high maturity and a lot of features, but lacks in support for B2B, cloud-native and manufacturer support.

Is this really true though? Last time I checked Keycloak was a RedHat project, meets the definition of cloud-native, and RedHat does provide RedHat Single Sign-On, a Keycloak-based service that is as B2B as it gets.

Also, further down the discussion you commented that the project doesn't even provide a Docker image, and instead you mention an ongoing rewrite that might provide a stand-alone binary.

https://news.ycombinator.com/item?id=31409609

How does that miss allow the project to even be considered cloud-ready, let alone could native?

View on HN

Currently we provide a container image as well as K8s support.

The v2 will allow us to extend our support to a plain binary as well as serverless containers (Knative et. al)

Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation.

If you feel that I am mistaken, feel free to point out the docs to that ;-)

> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation.

I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct?

We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.

From the IAM perspective (If the service is an IAM) I agree. But as SaaS provider I don’t want to use multiple realms because in that case my client would need to understand multiple issuers.

Also Keycloak has a cutoff of around 400 ish realms last time I checked ;-)

Do you have a source for the cut-off at around 400 realms?

Only my own experience and secondary sources https://keycloak.discourse.group/t/maximum-limit-of-realms/8... https://stackoverflow.com/questions/54465114/when-realm-coun...

Here's more about realms and keycloak from a different HN comment thread I participated in: https://news.ycombinator.com/item?id=31266603

I don't know abraae, but they seemed familiar with Keycloak.

Reply on news.ycombinator.com