Obligator
Infrastructure
self-hosted auth server
SHOW HN2023
273points
122comments
#175of 3,109 in 2023
Top 6%of 2023 by points
How HN took it
CuriousMostly questions and neutral comments
6 positive, 21 neutral or asking, 0 mixed, 14 critical, out of 41 comments about the project. Thread score -0.09.
Idea: 3 for, 2 againstDocs: 1 for, 4 againstDesign: 2 for, 2 againstPrivacy: 0 for, 4 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Turnkey, lightweight alternative to Keycloak and Dex
From 3 comments
This looks like exactly what I was looking for. I was looking for turnkey AuthN/AuthZ using OIDC for closed networks and self hosting, turnkey as in being able to drop a…
benkillin on HNi think most people look at keycloak, and just feel overwhelmed, but that seems to be the case for OIDC in general, they always feel insanely heavy, something like this with a…
cchance on HNOhh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though…
throwaway67743 on HN
Registration-free anonymous clients are a brilliant idea
From 1 comment
Genius. Not having to register is brilliant and I love it. I'll be watching this project and using it.
hkt on HN
Objections
Email magic links are less secure than other login methods
From 2 comments
Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security…
jupp0r on HNjust because email is often the defacto identity on the internet doesn't make it a good idea (bandwagon fallacy). i don't consider email tokens to be a serious form of…
v2223943777435 on HN
Security claims in the README are overstated
From 1 comment
> By forcing the user to decide whether they trust the actual domain where the ID token will be sent, and not displaying any sort of logo which can be faked, security is…
AceJohnny2 on HN
Comparison table is inaccurate for some projects
From 2 comments
Cool, but I looks like the creator didn't really look deep in the competition. Many of the question marks in the comparison table can be replaced by a checkmark.
Wronnay on HNI am only familiar with authentik. When I look at the comparison table it's super inaccurate for authentik. FYI.
dizhn on HN
Requests
LDAP backend support
From 1 comment
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though…
throwaway67743 on HN
SQLite support
From 1 comment
The race really does seem to be between ZITADEL and Ory for the next generation of OIDC servers. Any chance of sqlite support in the future?
apitman on HN
Questions
Which services can use it as an IdP without registration
From 1 comment
Can someone explain which services this is supposed to be an IdP for? As far as I know, services need to have the OIDC service registered (ie I can't just auth with this to…
stavros on HN
How it differs from Portier
From 1 comment
This looks like it has the same core functionality as Portier? https://github.com/portier/portier-broker I'm on mobile, so haven't really checked where we differ in details.
kosinus on HN
Alternatives named
Authelia
From 2 comments
If you're looking for something but more production ready, Authelia seems like a good option. Vouch and oauth2-proxy are even simpler but more specific in what they do. If you…
apitman on HNI was going to comment „but I can already do a lot of that with Authelia and it is very simple to configure“, but then I found your very good comparison page - good comparison! I…
moontear on HN
Keycloak
From 2 comments
How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout. https://www.keycloak.org/docs/latest/securing_apps/
snappysnap on HNPersonally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-docker…
KronisLV on HN
Dex
From 1 comment
Reminds me of https://github.com/dexidp/dex
salzig on HN
Ory Hydra and Kratos
From 2 comments
I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it? https://github.com/ory/kratos
sisve on HNThe Ory stack looks to be very high quality for sure. But so far in this thread there's been mentioned Hydra, Kratos, and Oathkeeper in order to run an OIDC server. You say Hydra…
apitman on HN
ZITADEL
From 1 comment
The race really does seem to be between ZITADEL and Ory for the next generation of OIDC servers. Any chance of sqlite support in the future?
apitman on HN
Authentik
From 1 comment
I am only familiar with authentik. When I look at the comparison table it's super inaccurate for authentik. FYI.
dizhn on HN