traefik-forward-auth vs pam-keycloak-oidc

traefik-forward-auth

Minimal forward authentication service that provides Google/OpenID oauth based login and authentication for the traefik reverse proxy (by thomseddon)

Source Code

Suggest alternative

Edit details

pam-keycloak-oidc

PAM module connecting to Keycloak for user authentication using OpenID Connect/OAuth2, with MFA/2FA/TOTP support (by zhaow-de)

Keycloak pam-module Oauth2 Oidc openid-connect

Source Code

Suggest alternative

Edit details

Our great sponsors

InfluxDB - Power Real-Time Data Analytics at Scale

WorkOS - The modern identity platform for B2B SaaS

SaaSHub - Software Alternatives and Reviews

Our great sponsors

traefik-forward-auth		pam-keycloak-oidc
	Project
32	Mentions	1
2,005	Stars	57
-	Growth	-
0.0	Activity	2.0
25 days ago	Latest Commit	9 months ago
Go	Language	Go
MIT License	License	MIT License

The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.

traefik-forward-auth

Posts with mentions or reviews of traefik-forward-auth. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2023-10-11.

Show HN: Obligator – An OpenID Connect server for self-hosters
18 projects | news.ycombinator.com | 11 Oct 2023
Authentik reverse proxy vs swag
3 projects | /r/selfhosted | 7 Jul 2023

BTW also keycloak and other similar products offer the oauth-proxy capability, I even used the original oauth2-proxy https://github.com/oauth2-proxy/oauth2-proxy for a while, but it was getting too difficult to maintain for me. I used for a while https://github.com/thomseddon/traefik-forward-auth that was a smart hack configuring a single upstream provider, but it look abandoned. So I was considering authentik but apparently it's just oauth2-proxy embedded in it, at that point why not use oauth2-proxy directly.
Traefik with traefik-forward-auth towards Azure AD loop-redirect and fail
2 projects | /r/Traefik | 11 May 2023

It seems there are some more recently updated forks.
Dell T320 vs T620 Idle Power
5 projects | /r/homelab | 28 Mar 2023

Traefik Forward Auth
Assuming I have each individual service working (cloudflare-tunnel, keycloak, nginx, arrs, dashy), how would I go about having a system like this? (more in comments)
3 projects | /r/selfhosted | 22 Mar 2023

One way I got this to work (for another app that doesn’t go through cloudflare) was to use Traefik with forward-auth and this: https://github.com/thomseddon/traefik-forward-auth
Just finished migrating my old tower servers to a Kubernetes cluster on my new rack!
19 projects | /r/homelab | 21 Jan 2023

In front of all of my private dashboards, I use Traefik Forward Auth to limit who can access them.
Is there something like Keycloak or Authelia that supports both forward auth and identity providers?
3 projects | /r/selfhosted | 8 Jan 2023

Hm, interesting. I have worked with traefik-forward-auth before, but I didn't know there is a fork. Are you using the fork? Would you happen to know if this issue from the original project still exists or if it's fixed in the fork?
How do you expose some of your services to the internet?
3 projects | /r/selfhosted | 28 Dec 2022

https://github.com/thomseddon/traefik-forward-auth (just another option if everyone accessing already has a google account)
Cant wrap my head around auth process
5 projects | /r/kubernetes | 21 Dec 2022

Traefik ingress + forward auth middleware + traefik-forward-auth does the trick.
SSO with keycloak and traefik
1 project | /r/selfhosted | 16 Nov 2022

Hey have u setup a forward auth? https://github.com/thomseddon/traefik-forward-auth

pam-keycloak-oidc

Posts with mentions or reviews of pam-keycloak-oidc. We have used some of these posts to build our list of alternatives and similar projects.

SSH Bastion Host Best Practices
1 project | /r/netsec | 15 Jan 2022

I'm using Keycloak with https://github.com/zhaow-de/pam-keycloak-oidc.

What are some alternatives?

When comparing traefik-forward-auth and pam-keycloak-oidc you can also consider the following projects:

oauth2-proxy - A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

authentik - The authentication glue you need.

authelia - The Single Sign-On Multi-Factor portal for web apps

casdoor - An open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA and RADIUS [Moved to: https://github.com/casdoor/casdoor]

vouch-proxy - an SSO and OAuth / OIDC login solution for Nginx using the auth_request module

kubelogin - kubectl plugin for Kubernetes OpenID Connect authentication (kubectl oidc-login)

awesome-zero-trust - A curated collection of awesome resources for the zero-trust security model.

Ory Hydra - OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.

Synology-Docker-Mediaserver - Working Docker media server containers running on Synology, served by Swag with auth via Organizr (and auth bypass for API, so NZB360 etc. work).

louketo-proxy - A OpenID / Proxy service

Traefik-with-Pomerium-Forward-Auth-and-Proxy-on-Kubernetes-with-Helm - Traefik with Pomerium in Forward Auth and Proxy mode on Kubernetes with Helm/Helmfile

kc-ssh-pam - KC SSH PAM is built to streamline the process of user authentication to access Linux systems through SSH with keycloak oidc