kanidm
Ory Kratos
Our great sponsors
kanidm | Ory Kratos | |
---|---|---|
12 | 41 | |
1,962 | 10,436 | |
5.2% | 5.9% | |
9.8 | 9.6 | |
7 days ago | 5 days ago | |
Rust | Go | |
Mozilla Public License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
kanidm
-
Simple LDAP / user management
Kanidm is a identity management platform with a ldap compatible interface, sso and more. It's still young, but the author works on the 389 ldap server at suse, so knows how to build a secure ldap alternative :)
-
Hacker News top posts: Oct 16, 2021
Kanidm: A simple, secure and fast identity management platform\ (22 comments)
-
Kanidm: A simple, secure and fast identity management platform
Here is the OAuth/OIDC issue: https://github.com/kanidm/kanidm/issues/278
They are talking here: https://github.com/kanidm/kanidm/pull/485 about being an IdP with support for OIDC, so once that is implemented you could probably federate to Keycloak (or any other compliant IdP).
Might be worth filing an issue, I'm sure they'd love the feedback.
Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings.
Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r...
It would seem simpler to go with the Ory approach of "best in breed" for, say network management tooling (most of which they already have implemented), and then integrate with Keycloak, Okta, FusionAuth, the Ory suite, etc for user management. Maybe they didn't want to do that because there are synergies with integrated user management? I dunno, seems like there are a lot of user management tools out there.
I also find it interesting that they explicitly disallow a goal of building a better LDAP server. I think there's a lot of room to run in that. My employer has had users show a fair bit of interest in a modern experience with LDAP layered on top ( https://github.com/FusionAuth/fusionauth-issues/issues/954 ) and I talked to someone at a conference that had built a whole business out of virtual LDAP: https://www.radiantlogic.com . They were working with companies with multiple LDAP based auth systems, and providing a way to have apps see one view of the user.
Maybe kanidm isn't that project, but it seems like a modern OSS LDAP implementation would be welcomed by the software community.
Disclosure: I work at FusionAuth.
-
Whats your favourite open source Rust project that needs more recognition?
Kanidm, it might not sound as fun or exciting but this sound engineering driven by exceptional people. Similarly, concread.
-
What's everyone working on this week (36/2021)?
saml-rs, creating a SAML IdP in rust, kind of spun out of trying to do it for Kanidm.
-
What are SUSE's biggest contributions to the Linux world?
And now they employ one of the lead 389 Directory Server developers (now the default in SUSE instead of OpenLDAP which is is still available but is going to be depreciated). The same person is also the lead developer of Kandim, a new beta IDM that looks really promising (but is likely quite some time from being ready for enterprise production).
Ory Kratos
- Show HN: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
-
Show HN: Obligator – An OpenID Connect server for self-hosters
I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it?
-
Show HN: Blueprint for a distributed multi-region IAM with Go and CockroachDB
I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited (https://github.com/ory/kratos/graphs/code-frequency) so I might have had a bad first impression.
A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I dont know if the owner are going to merge it.
An example that comes to mind is the OAuth email auto-verification or the search of users that is still super basic (we only recently got the filter of identifiers).
Sorry to hear that this has been your experience! What exactly was the issue for you? It’s true that there are lots of open PRs. We’re a small team and often busy with customer requirements which doesn’t allow us to get a some community PRs over the finishing line.
Sometimes, PRs are also not aligning with an architecture or API concept which is when they often go stale.
Saying that the open source is second class is a false accusation in my view:
- Over 1500 PRs merged in Ory Kratos alone: https://github.com/ory/kratos/pulls
- Show HN: Open-source IAM Ory Kratos v1.0 with Passkeys, MFA and multi-region
-
Show HN: Open-source Auth0 alternative Ory Kratos v0.13 released – nearing v1.0
Check out the milestone on github: https://github.com/ory/kratos/milestone/15
not sure if that is everything.
-
State of OpenID Connect Providers
An open source solution pre-built from professionals like Ory Kratos or Keycloak saves you a lot of time and pain.
-
Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities
One might say you wouldn't be surprised. Security practices at start ups have never been good (no regulation, focus on sales) but to see this lack of security awareness in a company protecting PII is shocking. But what do VCs know ...
As always when something like this happens, here are some good open source alternatives with appropriate security policies and bug bounties in place:
* https://github.com/keycloak/keycloak
* https://github.com/ory/kratos
* https://github.com/GluuFederation (potentially dated for some use cases)
- Something like Keycloak but in Go?
What are some alternatives?
Keycloak - Open Source Identity and Access Management For Modern Applications and Services
SuperTokens Community - Open source alternative to Auth0 / Firebase Auth / AWS Cognito
zitadel - ZITADEL - The best of Auth0 and Keycloak combined. Built for the serverless era.
Ory Hydra - OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.
Ory Keto - Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.
OPA (Open Policy Agent) - Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Vault - A tool for secrets management, encryption as a service, and privileged access management
authelia - The Single Sign-On Multi-Factor portal for web apps
frank_jwt - JSON Web Token implementation in Rust.
fusionauth-issues - FusionAuth issue submission project
casdoor - An open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA and RADIUS [Moved to: https://github.com/casdoor/casdoor]
cortex - A horizontally scalable, highly available, multi-tenant, long term Prometheus.