Gluu Blog

On the open-source authN/authZ front, I am aware of a few different projects. Would love feedback from anyone who has used or evaluated these (or others). Edit: These tools can be self-hosted and integrated to provide out-of-the-box auth functionality to your application. * The ORY ecosystem of tools [1] * Gluu [2] * Keycloak [3] [1]: https://www.ory.sh/docs/next/ecosystem/overview [2]: https://www.gluu.org [3]: https://www.keycloak.org

Off the top of my head: https://gluu.org/ https://www.keycloak.org/ https://github.com/OpenIdentityPlatform

We don't have definite plans to build a full-featured IDP, but we did build a Mock IDP we use in CI, QA and demos that could possibly be a starting point for your purposes? Other OSS IDPs include Keycloak and Gluu Server if you wanted to check those out! https://github.com/enterprise-oss/sinatra-ruby-idp https://www.keycloak.org/ https://www.gluu.org/

It can be easier to extend & customize[0] though. I went with IdentityServer4 on a recent project over Keycloak and Gluu[1] for that reason and because it was in the same stack as the rest of our ecosystem. [0] See comment from this thread https://news.ycombinator.com/item?id=22871756 [1] https://www.gluu.org/

I've been considering setting up a Gluu [1] instance for some of my services. It supposedly supports LDAP as well as OpenID and Oauth2 for authentication as well as RADIUS. From what I can tell, this would fit your use case perfectly fine. It's available as open source software but the company behind it is selling it as well in case you'd like a support contract. Note that I haven't set it up myself yet, it's still on my ever-growing list of "tools I have to take a good look at sometime in the future". It does seem like a very good piece of software though. [1] https://www.gluu.org/

Been there, done that - wish it upon no one. If anyone ever brings up the idea of building out oauth or even vaguely user management, I try to point them to at least try a POC (Proof of Concept) with https://www.keycloak.org/ (Apache 2.0 License) or https://www.gluu.org/ (MIT License) before they considering building.

https://identityserver.io/ https://fusionauth.io/ https://www.keycloak.org/ https://www.gluu.org/ Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.

My partner Mike Schwartz founded Gluu because he was tired of recommending proprietary access management platforms like Siteminder and IBM Tivoli that were locked behind six figure licenses. We're now a team of about 30 people with 10 years of development into the Gluu Server, a free open source software platform for SSO, 2FA, access management: https://gluu.org/docs/ce

What's the diff with Gluu https://gluu.org/ ?

I would be careful depending on Keycloak given what happened with CentOS recently: - https://www.gluu.org/blog/keycloak-is-the-next-centos/

Now is probably a good time to plug some of the open source alternatives to vendor locked in identity solutions: - https://github.com/ory - https://github.com/dexidp/dex - https://github.com/authelia/authelia - https://github.com/keycloak/keycloak - https://www.gluu.org/ - https://github.com/accounts-js/accounts

This introduction is pretty simple and concise to just understand what it is: https://www.cloudflare.com/learning/access-management/what-is-oauth/ Follow that up with this SAML and OAuth comparison: https://www.ubisecure.com/uncategorized/difference-between-saml-and-oa… Then see how OpenID Connect fits in: https://www.okta.com/identity-101/whats-the-difference-between-oauth-o… https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/ And this page shows examples of a web app using OAuth2: https://connect2id.com/learn/oauth-2

How do I find that discovery endpoint, given your email address @gluu.org? https://gluu.org/.well-known/openid-configuration doesn't exist. I don't even know that idp.gluu.org is a thing from your email address.

Personally I think of Authelia and Keratin as really good projects in the don't-build-auth-into-your-apps-ever-again space. If auth isn't already built into your app gateway/mesh/proxy, then these services might be something worth dropping alongside. A few more projects in this space: - Keycloak (you won't get fired for picking this)[0] - CloudFoundry's UAA[1] - Gluu [2] - ORY (Hydra + friends)[3] - Keratin [4] - OpenUnison [5] - Dex[6] - Netlify's GoTrue[7] All of these solutions are a bit different but here are some of the axes: - Whether or not they function as an OAuth provider - Whether they're centered around application-user-login via mechanisms like email/password, application auth, or SSO - Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue) - GUI availability - F/OSS-ness (basically all of them have very permissive licenses) [EDIT] More entries for this list in another comment @ https://news.ycombinator.com/item?id=26411457 [0]: https://www.keycloak.org/ [1]: https://github.com/cloudfoundry/uaa [2]: https://gluu.org/docs/gluu-server/4.2/ [3]: https://github.com/ory/hydra#what-is-ory-hydra [4]: https://keratin.github.io/authn-server/ [5]: https://github.com/tremolosecurity/openunison [6]: https://github.com/dexidp/dex [7]: https://github.com/netlify/gotrue