Hacker News Reader

Comment by vbezhenar | Hacker News Reader

My biggest problem with Keycloak is its configuration.

It stores its configuration in the database. It means that I can't just configure it in some yaml configmaps. There's no easy supported way to test some changes on test server and then move those changes to production. You need to click around in its UI and you better do it well, it's a security tool after all.

There's adorsys/keycloak-config-cli which is third-party solution which is supposed to somewhat mitigate this issue (you supply a config and it'll try to adjust keycloak instance to this config), but it's absolutely not first-party solution and does not work as well.

Please just store users in the database. Let me specify everything in config yamls, so I can change it and restart the server and that's about it. That's how gitops is supposed to work.

View on HN

I feel this problem (I also find configuring keycloak clunky) - but I understand their problem.

OIDC allows an arbitrary number of identity providers to register themselves - so there's not really a clear way to distinguish "config" vs "data" here.

That said - They've recently improved importing and exporting realms, and it really solved a lot of my pain. Mainly - you can now directly import/export realms in the UI, and the server doesn't need to be stopped.

Still a little more finicky than I'd like, but way less risky than having to reconfigure by hand.

I got burned using the k8s operator a while back. The old one, that had custom resource definitions for instances, realms, clients & users was deprecated and the new one is still so far behind in functionality that it's unusable for my purposes. (Iirc even setting up a custom ingress beyond the hostname was a pain, and setting up realms only works via importing exports, no setting up clients at all)

For my hobbyist project, I'm currently using the terraform provider, but that is third-party. [1]

I'm really torn on this, because on the one hand, Keycloak is undeniably a great tool with a lot of features that make it possible to integrate with almost anything you throw at it, but on the other hand, if you want to set it up in a reproducible, declarative way, you either have to trust a third party to maintain a provider, or the first party that already deprecated stuff way too early once - which is why I'll still use it for personal projects, but can't in good conscience recommend it in a professional capacity.

[1] https://registry.terraform.io/providers/mrparkers/keycloak/l...

Just use the terraform provider.

The Terraform provider[1] unfortunately is 3rd party and as such doesn't bring and guarantees of correctness other than that of the maintainer. It would be nice to see Keycloak provide an official solution for configuration management other than the K8s operator which is missing a lot of features.

[1] https://github.com/mrparkers/terraform-provider-keycloak

I suppose you could test your system including the Keycloak configuration to make sure things work as expected after a TF change. You probably want to be doing that anyway, though. It's a fairly comprehensive Terraform provider under active development, I recommend it.

Reply on news.ycombinator.com