7 ms·
Kratos is awesome, especially alongside Hydra, OathKeeper, and Keto. Super powerful combo, if not a little intimidating at first. There’s a LOT of configuration
by bitcrshr 10mo ago
Kratos is awesome, especially alongside Hydra, OathKeeper, and Keto. Super powerful combo, if not a little intimidating at first. There’s a LOT of configuration involved, but that’s to be expected if you want to host your own Auth0 replacement.
Their dynamic forms stuff is really cool too, always liked how they chose to go about that. Only complaint I really ever had is that while their docs were overall serviceable, I remember some areas were pretty lacking and I had to dig really far to find answers to some fairly common issues.
- throwaway894345 10mo agoI've often wondered why there isn't a simpler identity provider service that does the thing that ~90% of applications need without all of the complex configuration.
- ChristianJacobs 10mo agoHave you tried Pocket-ID? I use it for my home server with LLDAP as the identity provider.
- AlphaSite 10mo agoHonestly. We used dex. It worked pretty well.
- throwaway894345 10mo agoThanks for the rec. I’ll look into that.
- snowfield 10mo agoYou can host authentik with one click in docker. It's super easy to set up
- trenchpilgrim 10mo agoIronically, their hard dependency on Docker is a showstopper for me - none of my systems run Docker Engine, they use containerd and Podman, neither of which are supported.
- throwaway894345 10mo agoI hadn't heard of them, but I'm looking at their GitHub page now and they seem to support Kubernetes, which makes me think they must support containerd, right?
- trollbridge 10mo agoI run Authentik in podman; you could also in theory just run it without containers, although that would be obnoxious to set up.
- trenchpilgrim 10mo agoDo you have a repo or example somewhere I can look at? Thanks
- skrtskrt 10mo agoThe world of Auth has been made miserable with everything having to support OAuth2/LDAP/SSO/SAML etc., plus a million versions of access control, session configs, yadda yadda. Each of these has their own (usually legitimate) purpose, but also each one has to integrate with other providers that each don't follow and/or extend the spec in their own special way. And the pain goes on and on. Obviously you can make a product that only does really good username/password auth for example, but there's always more pressure to implement more things for another use case.
- vinckr 10mo agoAnother problem is also that "standards" like OAuth2/OIDC are used for a thousand use cases that weren't intended by the authors, so people get really creative with them. Plus the spec itself is vague on many essential things, for example how logout should work. Thankfully I never had to implement SAML but I would guess it's even worse there...