FreeIPA VS OpenID

Compare FreeIPA vs OpenID and see what are their differences.

Our great sponsors
  • WorkOS - The modern identity platform for B2B SaaS
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • SaaSHub - Software Alternatives and Reviews
FreeIPA OpenID
13 10
911 945
2.3% 2.1%
9.4 9.3
about 19 hours ago 5 days ago
Python C
GNU General Public License v3.0 only Apache License 2.0
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.

FreeIPA

Posts with mentions or reviews of FreeIPA. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2023-12-25.

OpenID

Posts with mentions or reviews of OpenID. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2024-02-11.
  • Keycloak SSO with Docker Compose and Nginx
    21 projects | news.ycombinator.com | 11 Feb 2024
    I did something similar, though picked Apache with mod_auth_openidc, which is a certified Relying Party implementation: https://github.com/OpenIDC/mod_auth_openidc

    In other words, I can protect arbitrary applications through my reverse proxy and require either certain claims/roles, or simplify auth to the point where my downstream app/API will just receive a bunch of headers like OIDC_CLAIM_sub, OIDC_CLAIM_name, OIDC_CLAIM_email through the internal network, not making me bother with configuring OIDC libraries for all of my APIs and configure them in each stack that I might use, but rather contain all of that complexity in the web server.

    Basically:

      user <==> Apache (with mod_auth_openidc) <==> API (with OIDC_ headers, if logged in)
  • What Is OIDC?
    3 projects | news.ycombinator.com | 21 Dec 2023
    > Don't outsource either your authentication or authorization. Run it in-house.

    This is hard to do, though. I hope people here will drop a lot of combinations that work for them!

    Personally, for a small/medium scale project, I went with:

    Keycloak: https://www.keycloak.org/

    It supports various backing RDBMSes (like PostgreSQL, MariaDB/MySQL and others), allows both users that you persist in your own DB, as well as various external sources, like social login across various platforms, is an absolute pain to configure and sometimes acts in stupid ways behind a reverse proxy, but has most of the features that you might ever want, which sadly comes coupled with some complexity and an enterprise feeling.

    I quite like that it offers the login/registration views that you need with redirects, as well as user management, storing roles/permissions and other custom attributes. It's on par with what you'd expect and should serve you nicely.

    mod_auth_openidc: https://github.com/OpenIDC/mod_auth_openidc

    This one's a certified OpenID Connect Relying Party implementation for... Apache2/httpd.

    Some might worry about the performance and there are other options out there (like a module for OpenResty, which is built on top of Nginx), but when coupled with mod_md Apache makes for a great reverse proxy/ingress for my personal needs.

    The benefit here is that I don't need 10 different implementations for each service/back end language that's used, I can outsource the heavy lifting to mod_auth_openidc (protected paths, needed roles/permissions, redirect URLs, token renewal and other things) and just read a few trusted headers behind the reverse proxy if further checks are needed, which is easy in all technologies.

    That said, the configuration there is also hard and annoying to do, as is working with OpenID Connect in general, even though you can kind of understand why that complexity is inherent. Here's a link with some certified implementations, by the way: https://openid.net/developers/certified-openid-connect-imple...

  • Easy to use OpenID Connect client and server library written for Go
    6 projects | news.ycombinator.com | 1 Dec 2023
    otherwise connections would randomly drop. I was looking for other ways to make development a bit easier and also settled on mod_auth_openidc, which is an Apache module that lets it act like a Relying Party and handle lots of the heavy lifting (protecting endpoints, refreshing tokens etc.) for me, and lets me work with just a few headers that are passed to the protected resources: https://github.com/OpenIDC/mod_auth_openidc

    It works, but I'm still not happy - I realize that there are many types of attacks that have historically been a problem and that certain OpenID Connect flows try to protect against, in addition to the fact that if I wrote my own security code it'd almost certainly be worse and have vulnerabilities (in the words of Eoin Woods: "Never invent security technology"), and it's a good thing to follow standards... but the whole thing is such a pain. Both OpenID Connect, Keycloak and configuring mod_auth_openidc.

    Right now I'm moving permissions/roles from Keycloak back into the app DB, with references to the Keycloak user IDs, because I don't want to have to work with the Keycloak REST API every time I want to change what a user can or cannot do in the system, in addition to permissions which might only apply conditionally (one user might be related to multiple organizations, having different permissions in the context of each).

    Regardless, it's nice that there are more pieces of software out there to choose from!

  • Show HN: Obligator – An OpenID Connect server for self-hosters
    18 projects | news.ycombinator.com | 11 Oct 2023
    Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-doc... although the fact that they want you to create an "optimized" image yourself and have a long build/setup process on startup instead is slightly annoying: https://www.keycloak.org/server/containers

    Regardless, with something like mod_auth_openidc or another Relying Party implementation, all of the sudden authn/authz becomes easier to manage (you can literally get user information including roles in headers that are passed from your gateway/relying party to apps behind the reverse proxy), regardless of what you have actually running in your APIs: https://github.com/OpenIDC/mod_auth_openidc (there are other options, of course, but I went with that because I already use mod_md).

    It's actually cool that there are plentiful options in the space, since OIDC is pretty complex in of itself and attempts at creating something pleasant to actually use are always welcome, I've also heard good things about Authentik: https://goauthentik.io/

  • Password protect a static HTML page
    20 projects | news.ycombinator.com | 18 Feb 2023
    > The user experience with basic auth is not so good.

    Apache actually also has an OpenID Connect module, which you can enable to have it work as a relying party: https://github.com/zmartzone/mod_auth_openidc

    Basically, the actual UI will be handled by another system that you might be using, for example, in my case that might be a self-hosted Keycloak instance: https://www.keycloak.org/

    I'd say that Keycloak is a pretty good solution in general, because it does some of the heavy lifting for you, maybe its shorter release cycle not being the best thing ever, though. I think IdentityServer also tried to fill this niche, but they went full on commercial recently, without OSS offerings.

  • SSO - For Plex, Emby and AudioBookShelf etc... How are you exposing these for remote access?
    3 projects | /r/selfhosted | 14 Nov 2022
    E.g. for Apache httpd there's mod_auth_openidc available.
  • Keycloak: Open-Source Identity and Access Management
    17 projects | news.ycombinator.com | 4 May 2022
    I really like https://tools.ietf.org/html/draft-ietf-oauth-security-topics with it's evergreen approach and looking forward to oauth2.1 to sum up the current best practices.

    Depending on your use case I have good experience with https://github.com/zmartzone/mod_auth_openidc and https://github.com/panva/node-oidc-provider.

    https://github.com/OpenIDC/pyoidc also might be a good choice as security researchers in that area did take a look in it...

  • How to Use OAuth to Add Authentication to Your React App
    5 projects | news.ycombinator.com | 12 Nov 2021
    I leave that the the module, I believe it uses client cookies by default, but I use a persistent server cache on disk (the session tokens are stored encrypted)

    https://github.com/zmartzone/mod_auth_openidc/wiki/Session-m...

What are some alternatives?

When comparing FreeIPA and OpenID you can also consider the following projects:

Keycloak - Open Source Identity and Access Management For Modern Applications and Services

FreeRADIUS - FreeRADIUS - A multi-protocol policy server.

Samba - https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git -- Merge requests should be made on GitLab (not on GitHub)

daloRADIUS - daloRADIUS is an advanced RADIUS web management application aimed at managing hotspots and general-purpose ISP deployments. It features user management, graphical reporting, accounting, a billing engine and integrates with GoogleMaps for geo-locating.

LDAP Account Manager (LAM) - LDAP Account Manager

OpenID/OpenID Connect

privacyIDEA - :closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP Server)

OSIAM

glauth - A lightweight LDAP server for development, home use, or CI

easy-rsa - easy-rsa - Simple shell based CA utility