SuperTokens Community VS authentik

SuperTokens

The Developer-First Security Week event is on August 7-11. The theme is shifting left with a security mindset with top expert speakers from Snyk, BoxyHQ, Microsoft, Google, Gitlab, Bearer, SuperTokens, Cerbos, and more...Come learn with us as the speakers dive into complex topics on Authorization, Authentication, Data Privacy.

GitHub: https://github.com/supertokens/supertokens-core Website: https://supertokens.com/

Signing up - You're not actually signing up to anything. Supertokens (open source auth provider) is running locally on your machine. It's just a means for you to be able to have an account (and soon invite others to your project to collaborate together). The data doesn't leave your computer.

I see a feature flag and a license check class.

https://github.com/supertokens/supertokens-core/tree/master/...

"[...] it is forbidden to copy, merge, publish, distribute, sublicense, and/or sell the Software." [1]

"Open source is source code that is made freely available for possible modification and redistribution." [2]

[1] https://github.com/supertokens/supertokens-core/blob/master/...

Take a look at supertokens which integrates with fastapi https://supertokens.com

Why are people still using Ory Kratos? It's still incredibly confusing documentation. Large fan of projects like: https://supertokens.com/ that focus on making authentication workflow implementation really easy.

GitHub Stars: 8.5 K GitHub Link: https://github.com/supertokens/supertokens-core

Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-doc... although the fact that they want you to create an "optimized" image yourself and have a long build/setup process on startup instead is slightly annoying: https://www.keycloak.org/server/containers

Regardless, with something like mod_auth_openidc or another Relying Party implementation, all of the sudden authn/authz becomes easier to manage (you can literally get user information including roles in headers that are passed from your gateway/relying party to apps behind the reverse proxy), regardless of what you have actually running in your APIs: https://github.com/OpenIDC/mod_auth_openidc (there are other options, of course, but I went with that because I already use mod_md).

It's actually cool that there are plentiful options in the space, since OIDC is pretty complex in of itself and attempts at creating something pleasant to actually use are always welcome, I've also heard good things about Authentik: https://goauthentik.io/

For Authentik, it looks like they are not interested to write how to configure HAProxy with it https://github.com/goauthentik/authentik/issues/5768

Have you tried /r/Nginx and /r/CloudFlare? And Authentik has a Discord server: https://goauthentik.io/discord and Github discussion and issues page: https://github.com/goauthentik/authentik/discussions

My thought is to have the ZAC only be accessible to users connected to OpenZiti, and to have the ZAC behind/to the side of Authentik for SSO.

We used keycloak for openid identity provider as well. It is fine to setup keycloak once. But it is painful share the setup with other engineers.

For local development, we end up using dex (https://dexidp.io). When we need support group/role, we use dex and glauth(https://glauth.github.io). Both dex and glauth can be configured with yaml files. We just created a few yaml files and a docker compose file, every engineer can be brought up the whole environment in a few seconds.

Also https://www.authelia.com and https://github.com/goauthentik/authentik look pretty promising, if you need more advanced features from them.

What do folks think about authentik[0]?

I tried to set up Keycloak but after fiddling with it for awhile before giving up and trying something else. It felt really weird that I was just extracting a tar and running a jar instead of some pre-packaged solution, but that might just be me.

authentik was pretty easy to set up for my homelab, but maybe I'm missing something given all the positive recommendations for Keycloak?

[0]: https://goauthentik.io/

I like this one: https://goauthentik.io/

Authentik has been working great for me. The developer is very active and any reported cve’s are patched accordingly: https://github.com/goauthentik/authentik/security

I'm guessing it's this issue. Seems to only be an LDAP issue, but yeah definitely needs more eyes on this one. https://github.com/goauthentik/authentik/issues/1644