ZITADEL Blog

Looks nice, we've been using https://zitadel.com/ and the journey to mutli-tennancy was fairly straight forward.

If you prefer an open source, and maybe more mature, alternative for multi tenant/b2b auth then have a look at https://zitadel.com (disclosure: work for zitadel)

Less known and less complete, but simpler and lighter than keycloak there is zitadel https://zitadel.com/ You can of course self host it.

I found Nate Barbettini's video on OAuth and OpenID Connect incredibly insightful for understanding these topics. He explains everything so well- https://youtu.be/996OiexHze0. Additionally, I'm part of the ZITADEL team, an open-source project that's free to download or use in our cloud offering. So, you can always tinker around with it as some others have already suggested. Our blog dives into various security topics, ranging from OAuth, OpenID Connect, and Single Sign-On, Authentication, Federation to emerging issues like Passkeys. We also discuss real-world Identity Management problems and solutions seen by ZITADEL users— https://zitadel.com/blog. For any specific security-related queries, feel free to join the conversation on our Discord chat: https://zitadel.com/chat. We're always discussing and sharing insights on these topics.

I've found https://zitadel.com/ to be a light weight version of keycloak. Lots of options that are useful, and pretty good UI for setting things up

When I was building a website and companion app, I researched a lot of the open-source options for auth. My primary requirement was ease of setup and operation. I didn't want to mess around with JVM dependencies and 100% didn't want to start messing around with k8s for such a small project. I was also very intimidated by the ORY stack. I didn't know how all the pieces fit together. And to self-host you pretty much need to run and orchestrate it on k8s. I'm not an auth expert, I just want a login thingy for my website/app. I'm not affiliated with it in any way, but I really liked what ZITADEL[1] is doing, in case anyone else is researching their options. It has a very simple interface to get started with, but also a ton of features. It being written in Go is a huge benefit since that makes it much easier for me to throw it up on my vps and calling it a day. 1. https://zitadel.com/

As a possible alternative, I've recently started using Zitadel (https://zitadel.com/) which is a very full-fledged open source IDP, in active development.

Very happy with https://zitadel.com It's open source but would be too much of a hassle to set up in your case, the cloud version you can integrate in a couple of minutes and has a generous free tier.

> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation. (See also: https://zitadel.com/blog/zitadel-vs-keycloak) I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct? We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.

Excellent writing and diagrams! If you want to expand your knowledge beyond OAuth2 (and most probably you should if you want to design systems used by big guys from 0 to 1) , highly recommend to jump straight into OpenID Connect (OIDC) which is an identity layer built on top of OAuth 2.0. Besides reading specs, Sascha Preibisch's videos on both OIDC and OAuth2 were the most useful to solidify a bigger picture for me https://www.youtube.com/@saschazegerman/playlists Specs are actually well written despite of all jargon and train of buzzwords used inside. The most annoying on my list are OP (OpenID Provider) and RP (Relying Party) ... https://openid.net/specs/openid-connect-core-1_0.html https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/ Most useful knowledge however personally gained from studying ORY Hydra mentioned in the article and Zitadel https://zitadel.com/ The problem with OIDC and OAuth2 space - IDP providers are too "creative" in their interpretation of specs starting from userinfo and token exchange endpoints. Without allocating significant amount of time getting all flows and related cyberops into your brain might never happened. Good news - it's a life time investment ... Oidc search on github gives good results - libraries, open source IDPs, all kind of proxies, etc https://github.com/topics/oidc

Sounds to me a bit like https://zitadel.com/

Zitadel is switching its license from Apache to AGPL3, that’s at least one difference. The license change caught my attention because I also use Zitadel, this project is MIT. [0] https://zitadel.com/blog/zitadel-v3-announcement

Hmm, maybe take a look at their website? https://zitadel.com/pricing

After working with Keycloak for a couple of years I honestly got fed up with all it's quirks and started to look at alternatives, Authentik and many more looked promising but Zitadel[1] caught my eye and I've never looked back since. [1] https://zitadel.com/blog/zitadel-vs-keycloak

Zitadel co-founder here. We support multiple approaches for multi-tenancy. In a typical setup you will only need an instance (a virtual Zitadel system). This already supports B2C and B2B deployments. If you want to host multiple customers, fully isolated, you could create an instance for each customer. However this is only necessary if you want to become a Zitadel service provider in most cases ;-) Some docs for this: Organization vs Instance: https://zitadel.com/blog/multi-tenancy-with-organizations Instance: https://zitadel.com/docs/concepts/structure/instance Organization: https://zitadel.com/docs/concepts/structure/organizations Hope this helps!

Interesting pricing model: https://zitadel.com/pricing/v2 Price per request isn't as common of an identity pricing model as MAU is. (Only applies if you host with them, of course. If you self-host, I believe it is free.)

Curious. I'm not using Zitadel yet, but we are planning to. It seems to support all of those features. What was the missing part for you? https://zitadel.com/docs/apis/saml/endpoints https://zitadel.com/docs/guides/integrate/identity-providers/ldap https://zitadel.com/docs/concepts/features/selfservice#mfa--2fa https://zitadel.com/docs/guides/migrate/introduction#multi-tenancy-arc… https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhosting