(no title)
twexler | 3 years ago
Honestly, most of these companies would be better off using Google, Azure or AWS' SSO-as-a-Service product (if that's what you're hoping to get out of Keycloak).
That's not to say that I don't appreciate that there's an open-source alternative out there, however.
toomuchtodo|3 years ago
parkerhiggins|3 years ago
Interesting enough is it looks like it will be provider agnostic.
You could use the “raw” saml endpoint provided by the service, a Google Identity endpoint, Okta provided saml endpoint, shibboleth on-prep protected by Tunnels, jumpcloud etc.
There’s even an saml/SSO preview of what data will be sent to the application upon authZ by the Identity Provider. There’s configuration rules already in place (AuthN) that can be applied to Organizational Units based upon the user’s metadata.
It’s a pretty clear bet at this point that Cloudflare will be making an entrance. Considering they used Okta internally performing a rapid investigation of the breach, (1) is the right thing to do as a service provider/rails to the internet (2) is strong product marketing for their future product (3) can be used to gain internal support for replacing Okta with their own product
twexler|3 years ago
mschuster91|3 years ago
The thing is, your Keycloak instance is not going to matter to any hacker, particularly if it's inside a VPN and not reachable from the Internet - and while we're at it, fuck zero-trust because it is essentially the same level of stupidity as using Okta, you're once again putting all your eggs into the basket of whatever provider you choose.
Your SSO-as-a-service provider however? They're the juiciest target out there that is. Everyone from secret services over enemy nation states to your average cyber-criminal is looking to get access there. And as we've seen, all it takes is a couple teenagers and a couple thousand dollars.
Good network design costs a lot of money to set up, particularly to limit the scope of an attack (e.g. because the VPN software had a vulnerability), but it's orders of magnitude better in the long run than to outsource core IT to some incompetent fools with subcontractors.
twexler|3 years ago
This doesn't make it particularly usable as SSO...
>Good network design costs a lot of money to set up, particularly to limit the scope of an attack (e.g. because the VPN software had a vulnerability), but it's orders of magnitude better in the long run than to outsource core IT to some incompetent fools with subcontractors.
This is exactly my point. Most businesses not not have the resources to maintain this level of infrastructure.
Additionally, I'm personally of the opinion that walled gardens with VPN entry points are a particularly good choice for modern businesses these days. Even the White House OMB is pushing the beyondcorp model in their recent recommendations for ZT.
agilob|3 years ago