Hacker News Reader

Hacker News

Comment by anon84873628 | Hacker News Reader

Parent Full thread

anon84873628

Building an entire directory app is hard though. And you want it to be highly resilient, right?

What do you recommend?

View on HN

Keycloak [1]. Rock solid, supports everything, trusted everywhere.

1: https://www.keycloak.org/

I have to disagree with your assessment. It's not that rock solid, "supports everything" is a very vague term and "trusted everywhere" I'm not even sure that that is supposed to mean.

The docs are really poor. It makes me less confident that I have configured everything correctly.

They're desperate to get off keycloak at my org. Not sure the specifics, but our users complain about Auth issues often, and the keycloak web interface is painfully slow too.

I’ve read you need to partition usage to limit each keycloak instance to about 1500 total users to avoid performance issues. Does this hold true in your org?

Not saying this isn't true, but wtf? How could such a laughable number of users cause any kind of performance issue?

It looks like it's 'entities' and not just 'users'. From the docs [0]:

  Keycloak allows you to create any number of realms and any number of clients and users in them. But you need to be thoughtful as you scale up because as the number of entities grows, Keycloak slows down. When you log in as a superuser in the admin panel, even if you have only 1,500 realms, it will take a few minutes or even crash on timeout. Creating a new realm will take about 20 to 30 seconds. You need to change your logic and interaction with Keycloak.

[0]: https://www.redhat.com/architect/oauth-20-authentication-key...

I work for a competitor. I haven't heard that, but have heard of perf problems with > 1000 realms (tenants).

https://keycloak.discourse.group/t/maximum-limit-of-realms/8... has some details, though comments are 1-2 years old so may be out of date.

I work with an org that has 10's of thousands of users on keycloak, so there must be a way around the problem. I'm not administering the instance for this project, so I have no direct insight into how they deal with it.

I work for FusionAuth which has a free community edition[0], so I'm a bit biased. You can read some of our community stories talking about what folks have built on top of it[1].

Other alternatives I've heard mentioned for self-hosting include:

* Ory

* Platform specific OSS (Devise for Rails, Passport/NextAuth for javascript, Spring Security for Java, etc)

* IdentityServer (may have to pay something now, not sure)

* Keycloak (as other comments have mentioned)

* Supertokens

0: https://fusionauth.io/download

1: https://fusionauth.io/blog/tag/community-story/

FreeIPA is pretty good for internal users when money is tight. It's a FOSS almost AD but for *NIX and it does HA. For the SSO part, Shibboleth2 or CAS.

There was a recent discussion on Obligator recently, I did not test it. But they have a nice table with a list of providers : https://github.com/lastlogin-io/obligator#comparison-is-the-...

Reply on news.ycombinator.com