Centralized user management #51

New Issue

Open

opened 2023-11-23 20:20:20 +02:00 by inex · 2 comments

inex commented

2023-11-23 20:20:20 +02:00

Owner

This issue created to track our work and exploration on the topic of SSO.

Key protocols

LDAP
OAuth
OpenID Connect
SAML

Software candidates

Keycloak — Java, there is a Nix module.
OpenLDAP — There is a Nix module.
Ory — Go, not properly packaged in Nix.
Casdoor — Go, not packaged.
authentik — not packaged.
Authelia — Go, there is a Nix module.
ZITADEL — Not packaged.

Services protocol compatibility

Service	LDAP	SAML	OAuth2	OpenID	PAM
Nextcloud	+	+	?	?
Email	+				+
Vaultwarden	+
Gitea	+		+	+	+
Pleroma	+		+
Mastodon	+	+	+	+	+

This issue created to track our work and exploration on the topic of SSO. # Key protocols - LDAP - OAuth - OpenID Connect - SAML # Software candidates - [Keycloak](https://www.keycloak.org) — Java, there is a Nix module. - [OpenLDAP](https://www.openldap.org) — There is a Nix module. - [Ory](https://www.ory.sh) — Go, not properly packaged in Nix. - [Casdoor](https://casdoor.org) — Go, not packaged. - [authentik](https://goauthentik.io) — not packaged. - [Authelia](https://www.authelia.com) — Go, there is a Nix module. - [ZITADEL](https://zitadel.com) — Not packaged. # Services protocol compatibility | Service | LDAP | SAML | OAuth2 | OpenID | PAM | | ----------- | ---- | ---- | ------ | ------ | --- | | Nextcloud | + | + | ? | ? | | | Email | + | | | | + | | Vaultwarden | + | | | | | | Gitea | + | | + | + | + | | Pleroma | + | | + | | | | Mastodon | + | + | + | + | + |

👍 2

inex added the

enhancement

label 2023-11-23 20:20:20 +02:00

inex referenced this issue

2023-11-23 20:21:00 +02:00

Implement LDAP protocol #39

inex commented

2023-11-23 22:07:06 +02:00

Poster

Owner

Authelia is lightweight and may use the list of users provided by the YAML file, so we may use more-or-less in a declarative way.

However, it is a reverse-proxy companion. It only supports session cookies, OpenID Connect and trusted headers.

The solutions like Keycloak and authentik provide a wide range of protocols but eat a lot of ram.

Authelia is lightweight and may use the list of users provided by the YAML file, so we may use more-or-less in a declarative way. However, it is a reverse-proxy companion. It only supports session cookies, OpenID Connect and trusted headers. The solutions like Keycloak and authentik provide a wide range of protocols but eat a lot of ram.