#keycloak

@dansup@mastodon.social Full agree: the Fediverse needs to become easier and more familiar to use. But that should mean open, self-hostable standards too. I would really like to see #OIDC / #OpenID Connect as a built-in option — like #Mastodon supports, or #PeerTube can gain through plugins — alongside Sign in with Apple, Google, etc. For Pixelfed, an easy .env-based configuration for a generic OIDC provider would be ideal: issuer URL, client ID, client secret, scopes, redirect URI — done. That would let instance admins use #Keycloak, #Authentik, #Zitadel, their university/work SSO, or any other compatible provider. Does #Loops have plans for generic OIDC login? And is this planned for #Pixelfed as well? Making sign-up familiar matters. Making it interoperable and self-hostable matters just as much. #OpenIDConnect #SelfHosting #Fediverse

Hey fellow #homelab and #selfhosted users! I am looking for a replacement for our #freeipa setup. We need a simple user management (users, groups, password self-reset), authentication via SSH, and SSO (using OpenID Connect). I found recommendations for #keycloak #kanidm #authentik and #pocketid (the latter in combination with #lldap) but it seems these not only differ substantially in functionality but are also for different purposes?! Some can even be combined as not all of them provide identity and access management?! Could one of you bring some light into the darkness for what (and, in case, in which combination) these are to be used for? I'd also highly appreciate recommendations and/or to learn from your own experience running any of these services. We'll be dealing with around 50 user accounts. Thanks a lot in advance! #boost welcome

It's been a while since my last post and a lot has happened. Hence, a quick update. I've fully migrated from #freeipa to #kanidm by now and while this path was definitely not without (also major) problems and a lot of back and forth also with the developers, I overall don't regret the decision at all. While kanidm arguably falls behind in popularity/visibility compared to #authentik, #keycloak, etc and seemingly also has (much?) less developers, and development therefore feels slower, it scores with simplicity and by offering exactly what I need. See here for a quick comparison: https://kanidm.com/comparisons/ I have around 10 services connected to it and all is working fine (finally now). What is a bit annoying about OIDC is that not all services offer OIDC out of the box, i.e. sometimes additional plugins are needed. The other annoying thing is that OIDC implementations differ, e.g. in how group mapping are used (if at all). If you are looking for a one-stop solution that offers OIDC, SSH key provisioning and replication - don't look any further.

Five Apache Camel vulnerabilities enable server-side request forgery and a Keycloak authentication bypass. Upgrade to 4.21.0, 4.18.3, or 4.14.8. #ApacheCamel #SSRF #AuthBypass #Deserialization #Keycloak #InfoSec https://meterpreter.org/apache-camel-five-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

#keycloak : Wie aus Projekten ein Competence Center und ein Produkt entstand https://blog.inventage.com/blogs/keycloak-competence-center/ #inventage #iam

Achievement unlocked: SSO for the hypervisor! 🎉

My Proxmox VE is now officially using Keycloak OIDC for authentication, and the setup is fantastic:

• Centralized Users: Managed alongside my other apps (Keycloak using my LDAP as the backend).

• Hardware MFA: Locked down with a FIDO2 stick from @nitrokey@social.nitrokey.com

• Unified Control: Centralized policies, logging, and RBAC across the board.

Another great improvement for my HomeLab/SelfHosting setup.

#Proxmox #Keycloak #DevOps #Auth #OpenID #Homelab #SelfHosted

📺 https://peer.adalta.social/w/hokz8ZLSvRJH4qZUe71Zvw 🔗 🇩🇪🇺🇸🇫🇷

Die vollständige Kontrolle über Daten und Systeme erfordert eine Abkehr von proprietären Plattformen hin zu offenen, selbstverwalteten Desktop-Ökosystemen.

#linux #fosdem #available #keycloak #linuxdesktop