Hacker News Reader

Comment by roboben | Hacker News Reader

I don’t get it. Keycloak feels like some clunky 90s enterprise software and I mean it only in a bad way. Had to run it on openshift and it was hell. It’s not really made for containers, clustering is basically impossible, it needs to know it’s default route and I can’t remember the exact issue but found myself patching some obscure startup scripts which templated some XML to start that thing. Can’t recommend but I’d be happy to hear alternatives which are actually modern.

View on HN

Disclosure: I work for FusionAuth.

We've had a number of folks migrate from Keycloak due to some of this clunkiness, but I do know they've done some major overhauls recently (moving to Quarkus amongst other things).

It also used to be super resource intensive if you have a large number of realms (which is what Keycloak calls tenants and Cognito calls user pools). From this 2022 link, more than 100-200 can cause issues: https://github.com/keycloak/keycloak/discussions/11074

Are we using the same piece of software? I have it deployed in production on kubernetes using the bitnami helm chart and everything works like a charm, clustering etc. No need to modify any XML or care about network routes.

How do you handle backups? I was considering doing the same, but found that backing up different systems inside k8s can be difficult.

We use KC with PostgreSQL as backend data store. Backup is done by backing up the PostgreSQL database.

If you actually want to transport configuration across environments (DEV, QA, PROD), then you want to export realms and have it load by KC on startup or import it using the UI.

There's a good Terraform provider for consistent configuration across environments, too.

It's on my list of things that assumes out of the box that you know waaaaaay more about dozens of details than you actually are likely to unless you've already used it for 10 years. To the point that I don't even know what the benefit of using it vs. other options is at all.

I can’t understand your first sentence even after reading it ten times. Maybe it is too long for me.

To the second sentence: I don’t know what the benefit is either but in some environments you are not able to use any cloud provider or other external service to realize the auth layer so you are stuck with things like keycloak. Hope this thread discusses some other solutions which you can self host.

I know the two main competitors that have been adopted by the self hosted community are authentik and authelia, they’re both somewhat under developed for enterprise but at the same time still difficult to grasp for non-full time devOps people. At least in my opinion.

I use authentik for self hosted - it's great but still too powerful and configurable for me or most people who are not auth experts to customise. Just creating a password reset flow requires integrating a dozen moving parts. The only explanation how to do it is a yaml file or a YouTube tutorial.

Setting up basic forward auth or OIDC was super easy though.

use cases that require _everything_ "on-premise" are often government/military, big healthcare, or just huge enterprises that want to control everything (and can afford a team that only runs their auth service).

I mentioned Ory above but you get both options - either as a managed service or run on your own infra

Or just places that don't want to give data to external, VC-funded or worse, vendors.

I have clients that definitely prefer combination of open source + owner-controlled + lower costs ;)

Yep, this is why I have been evaluating it recently. Have a customer that wants SAML 2.0 support, others that want LDAP support, 2FA support, and multi-tenancy support, while being something we can self-host. The other main suggestions I have seen - ORY or Zitadel - tend to be missing at least one of those (from what I can tell).

Keycloak looks like a big complicated monster, so I would prefer to stay away except that it looks like I will be required to have all that complexity to support all the use-cases we are looking at.

Curious. I'm not using Zitadel yet, but we are planning to. It seems to support all of those features. What was the missing part for you?

https://zitadel.com/docs/apis/saml/endpoints

https://zitadel.com/docs/guides/integrate/identity-providers...

https://zitadel.com/docs/concepts/features/selfservice#mfa--...

https://zitadel.com/docs/guides/migrate/introduction#multi-t...

https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhos...

As far as I can tell, Zitadel cannot be used as a SAML client, only as a provider. One of my requirements is that we use customer-provided (and controlled) SAML for SSO. Otherwise it was looking very promising.

They mean that the software relies on the user understanding its, or the industry-it-serves's, jargon, to be used effectively.

Which is extra funny when Keycloak is sticking to jargon out of RFCs that nobody else in the SaaS identity space is using. Hooking up Keycloak to a SAML consumer that only documents SaaS configuration is a fun game of try until it works most of the time.

Have you had a look at Ory (Kratos)? Its a "cloud-native"/modern alternative to Keycloak: https://github.com/ory/kratos

I have, and we went back to keycloak- everything the parent says is true, however Ory/Kratos is a lesson in half finished solutions and poor documentation.

we really tried quite hard, since it was backed by CNCF, but it could just be a case of being a tad too immature for prime time.

it seems keycloak is now CNCF though

Ory Kratos is nowhere near Keycloak. First of all, one needs at least Kratos+Hydra (there’s an integration method now out of the box yay) but Keycloak still has a flexibility advantage. Keycloak has many more features out of the box comparing to the complete Ory stack.

The only thing nicer in Kratos from Keycloak is the standalone self-service UI with JSON identity declaration. If someone from the Keycloak team is reading this, please, let’s have a talk about bringing that feature to Keycloak, then Keycloak will be perfect. The template approach is a bit of a hassle.

Source: deployed both stacks in production systems.

Another significant advantage of Kratos is that it's written in Golang, so it takes little to none resources for simple use cases.

Also my experience with Keycloak in the past was that you can't do zero downtime deployment, or true configuration as code.

Found Ory (Kratos) customised registration flow as something over-engineered for my personal use cases.

Very impressive ecosystem nevertheless.

Show HN: Ory Kratos https://news.ycombinator.com/item?id=31679811

Most HN comments are still relevant

What's nice about Ory Kratos/Hydra/Oathkeeper is that you can set 'groups' for your individual clients. In Keycloack that'd have to be a realm per client and if you have more than a couple, screw it. Don't know if something changed with Keycloack in last two years, but that's what nudged us towards Ory. Also, not sure how fast keycloack can get (plus caching) if you want to put it on-front of an API as an auth and throttle solution (you probably can't).

Whilst I agree keycloak is a lil clunky, I had it working clustered in k8s ~8 years ago.

I do recall the gossip protocol presenting problems back then, but now I believe the helm chart just works.

Were you using Keycloak also as the identity provider?

IIRC, if you're using an external identity provider, and you want clustering, you can just deploy Keycloak containers and load balance between them. You can then load a shared cache if you want (or need).

My memory is fuzzy right now, but although it isn't the leanest solution, I don't remember it as terrible. Ours wasn't a very custom solution anyway, we just hit an LDAP in the back and that was all.

I just docker-compose up'd the server and configured it. I don't know when you last needed to mess with it, but the containerised version seems quite easy.

Configuration sucked, but that's because Keycloak can do an awful lot.

Most of those issues have been sorted out in recent versions. It’s all container-ready now with pretty solid k8s story.

They completely reworked the code base and made it k8s compatible

BC gov?

Reply on news.ycombinator.com