Vault VS Keycloak

Cloud platforms provide tools like AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager for exactly this purpose. These services, which evolved from patterns Mitchell Hashimoto pioneered with Vault in 2015, store and encrypt your configuration.

Secure Secrets: Consider using Terraform’s Sensitive Variables or integrating with secret management tools like AWS Secrets Manager or HashiCorp Vault.

OpenTofu, (forked from Hashicorp Terraform), is a newer example along with OpenBao (forked from Hashicorp Vault). When HashiCorp changed the license for Terraform and Vault to the Business Source License (BSL), the community quickly responded by forking the project under the name OpenTofu & OpenBao. These forks aim to preserve the tool’s open nature and ensure that the developer community has a truly open source alternative to some of the industries widely adapted softwares.

When designing a Go project, look to real-world examples like Kubernetes, Vault and the Golang Standards Project Layout. These showcase how powerful Go can be when the architecture embraces simplicity over rigid structure. Rather than trying to make Go fit a Clean Architecture mold, embrace an architecture that’s as straightforward and efficient as Go itself. This way, you’re building a codebase that’s not only idiomatic but one that’s easier to understand, maintain, and scale.

> Bootstrapping a new system is checking in their ssh key and running a shell script.

If it interests you, both major git hosts (and possibly all of them) have and endpoint to map a username to their already registered ssh keys: https://github.com/mdaniel.keys https://gitlab.com/mdaniel.keys

It's one level of indirection away from "check in a public key" in that the user can rotate their own keys without needing git churn

Also, and I recognize this is departing quite a bit from what you were describing, ssh key leases are absolutely awesome because it addresses the offboarding scenario much better than having to negatively reconcile evicting those same keys: https://github.com/hashicorp/vault/blob/v1.12.11/website/con... and while digging up that link I also discovered that Vault will allegedly do single-use passwords, too <https://github.com/hashicorp/vault/blob/v1.12.11/website/con...>, but since I am firmly in the "PasswordLogin no" camp, caveat emptor with that one

HashiCorp Vault is a powerful tool designed for securely managing secrets and protecting sensitive data. It provides a unified interface to access secrets and protect sensitive data using a variety of methods such as encryption, access control, and dynamic secrets generation. Vault is widely used in modern infrastructure to ensure that sensitive information, like API keys, passwords, and certificates, is handled securely and accessed only by authorized entities. This guide aims to walk you through the process of deploying a production-ready HashiCorp Vault server on an AWS EC2 instance. The goal is to help you set up a secure, highly available, and scalable Vault environment that meets the needs of a production system.

Vault - For service authentication and key management.

This is a sample project to initialise a HashiCorp Vault instance with a PKI Instance and generate some secrets that can be used by the ForgerRock Identity Platform.

I have been working with YugabyteDB for a while now. I am always experiment with yugbayte + (something). Today, its Vault.

Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/

One common approach is to use an external Infinispan with a database persistence to store sessions outside of Keycloak, at least until version 26 makes the user session persistence feature (introduced in Keycloak version 25) a permanent part of Keycloak, moving beyond its previous preview status.

In today's interconnected digital landscape, companies often collaborate to provide seamless services to their users. In this post, we’ll explore a scenario involving two hypothetical companies: MyDoctor and MyHealth. We’ll demonstrate how MyHealth users can log in to MyDoctor using their MyHealth credentials, and how MyDoctor's backend can securely call MyHealth's APIs on behalf of the user. To achieve this, we’ll leverage OAuth 2 Token Exchange (RFC8693) with Spring Security and Keycloak.

Does not have LTS support so major version upgrades may be necessary when security patches are released. However, major version upgrades may cause breaking changes (which I have encountered a few times).

export KC_VERSION=24.0.4 curl -LO https://github.com/keycloak/keycloak/releases/download/"${KC_VERSION}"/keycloak-"${KC_VERSION}".zip

Keycloak is an open-source project created by RedHat for Single Sign-On. It provides an Identity and Access Management (IAM) solution designed to secure application services. Additionally, it enables users to authenticate through various identity providers and use fine-grained permissions for regulating access to Software as a Service (SaaS) applications.

In this article we'll be using Keycloak to quickly secure a Angular application with user management and single sign on (SSO) using the open source IAMs Keycloak for Authentication and Authorization. We will demonstrate the integration by securing a page for logged-in users. This quickly provides a jump-off point to more complex integrations.

Keycloak is definitely not small but you might find that you can ignore enough of the functionality to pretend that it is.

https://github.com/keycloak/keycloak