6 ms·

I love the ability to directly run docker containers. I think their approach to authentication / authorization is insane (not in a good way).

• _kb 10mo ago
  Those auth UX challenges are being worked on: https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/497 https://github.com/lxc/incus-os/issues/497 IMO the client certs are pretty elegant from a technical perspective. It works well with the CLI, but the browser experience is different enough to cause at least some base level wtf-ery.
  • stormking 10mo ago
    Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
    • stgraber 10mo ago
      Yeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra. TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.