helm-charts VS oauth2-proxy

Before we can authenticate OpenSearch against Keycloak, we'll need to install Keycloak. The following Ansible snippet demonstrates how to deploy Keycloak onto a Kubernetes cluster using the codecentric helm chart.

HA Keycloak on top of Kubernetes https://github.com/codecentric/helm-charts/tree/master/charts/keycloak I dropped the chart db in favor of https://github.com/zalando/postgres-operator

Having experienced the issue of identity management in past projects (I've literally published 5 web apps which became some iteration of user-profile applications), I found Keycloak to be of particular use when it comes to managing users and federating accounts. Keycloak is an open-sourced enterprise service which manages identity, authentication, authorization, and account federation which is part of the JBoss project and backed by RedHat. Since I wanted to use the Keycloak helm chart the Keycloak service runs using a Postgres backend.

That is not how you do Zero Trust. You want to use an Identity Aware Proxy. There are lots of ways you can implement this with Google as your core auth. For example Pomerium or oauth2-proxy.

I use self-hosted Apache Guacamole (RDP) through a reverse proxy with Google SSO (oauth2-proxy[0]). So easy to access my desktop from virtually any browser (mobile isn't the best though). This would be a good solution for gaming, but for other activities RDP is unbeatable imo.

[0] https://github.com/oauth2-proxy/oauth2-proxy

Meet https://oauth2-proxy.github.io/oauth2-proxy/ It could be deployed in the cluster somewhere and reuse it where needed. We do this to authenticate prometheus,alertmanager ui for useres

BTW also keycloak and other similar products offer the oauth-proxy capability, I even used the original oauth2-proxy https://github.com/oauth2-proxy/oauth2-proxy for a while, but it was getting too difficult to maintain for me. I used for a while https://github.com/thomseddon/traefik-forward-auth that was a smart hack configuring a single upstream provider, but it look abandoned. So I was considering authentik but apparently it's just oauth2-proxy embedded in it, at that point why not use oauth2-proxy directly.

Like auth basic? Mate, its 2023 get that RestAPI endpoint behind an OAuth proxy. github.com/oauth2-proxy/oauth2-proxy is a good one on a budget or use some cloud provider's ApiGateway and IAM services.

A final option would be oauth2-proxy which I also tried out in the past. It was pretty easy to get going, but also quite barebones. However maybe that would be fine for my usecase. Still something to investigate.

I use it in combination with oauth2-proxy, which sits in front of my network and the various services I host. https://github.com/oauth2-proxy/oauth2-proxy

Under the hood Authentik just uses https://github.com/oauth2-proxy/oauth2-proxy. The preconfigured proxy is convenient but if you already have a SSO provider you don't need to switch.

I recommend https://github.com/oauth2-proxy/oauth2-proxy

Have a look at oauth2-proxy. I wanted to do something similar - I wanted to access the various services running on my home network over the internet, but keeping them secure.