Selfhosted

Keycloak seems complicated, but it's actually not that complicated if you use it for simple OIDC provider.

Just create a new realm, then go to client -> create. Enter your client-id, with openid-connect as protocol. Then, set access type to "confidential", set valid redirect uri to "https://" (or even "https://*" if you're lazy and want to use it on multiple apps). Then hit save and go to the credential tab to copy your client secret. Then head to "users" menu to start adding users to your realm.

That's the basic setup which should be good for home use. The good thing about keycloak is, as you grow your homelab, whatever stuff you may need later can be provided by keycloak. Want some users to have access to app A, but not app B? 2 factor auth? Allow users to login with google account? Heck, allow users to login with another sso provider (chaining)? You can do pretty much anything.

I use kanidm with oauth2-proxy. No issues so far, it was pretty easy to set up.

Note that the connection to kanidm needs to be TLS even if you have a reverse proxy!

EDIT: currently using 80MB RAM for two users and three Service Providers.

I use authentik. The login flow is a little weird I agree, my password manager doesn't like it too. Besides that, from the ones I used it's definitely the most stable and developed (I was using authelia before).

I can't quite figure out how to use it with proxy auth.

Depending on what you are trying to do, Authelia does have OIDC in beta https://www.authelia.com/roadmap/active/openid-connect/

I use Authelia again since in beta it now supports multiple Pass/FIDO keys via the web interface, and it does work reasonably well.

Authentik works very well and has the most flexibility if you have the resources to run it (not an rpi)

You can change the logon flow to make the username and password on the same page

Another user mention issues with password managers auto filling. There is a comparability button as well on the login flow that allows bitwarden and other to auto fill correctly.

Authentik has LDAP built in along with every SSO method that exists. Makes it super nice to integrate into as many services as possible.

I use it with oAuth, LDAP and reverse proxy authentication.

I'm pretty happy with Authentik. Bitwarden at least has no issues with auto-filling the username and password fields when I want to log in.

It is also a very complete solution offering basically any current authentication protocol and integration with other providers.

I've been using Authelia for almost 2 years and I really like it. Never had any issues.

Sorry for the off topic question, but what are the gains / constraints of using an identity / authentication service? Sure, you only are going to need to remember one password/identity. But each webapp must have support for the said protocol, and so does their clients, no? It does seem like a lot of work (and risk exposure) for little gain.

Please enlighten me if I'm missing something.

Why not keep everything in your LAN and setup a wire guard bastion ?

check out vouch proxy.

I have been looking into this: https://gitlab.com/yaal/canaille to extend my LLDAP, but it can also work without an LDAP backend if you only need OIDC.

• Authentik is pretty resource intensive. Needs something like 3 servers/instances. A database, a server and a worker. Uses something like 800+ MB ram just for this service. Since I run my services on raspberry Pi 3s, I ended up moving away from this
• Keycloak works great but is a bit difficult to set up and doesn’t support all the authentication protocols that Authentik does

unpopular closed source option: cloudflare access after a cloudflare tunnel

Authelia does support oidc and its amazing.

I've been using Authelia with several OIDC integrations for a while now. Works great. They've released a huge update like a day ago too. Out of the ones you listed, it's very lightweight too. The docs are a bit all over the place but it is quite comprehensive.

I did look at Zitadel and tried setting it up myself but I just couldn't get it to work. The docs are a bit vague.

Padlock

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

6 acronyms in this thread; the most compressed thread commented on today has 18 acronyms.

[Thread #606 for this sub, first seen 16th Mar 2024, 12:15] [FAQ] [Full list] [Contact] [Source code]