I have a lot of different services which I self host for me and my family like:

  • PeerTube
  • Lemmy
  • Mastodon
  • Synology NAS
  • TTRSS
  • NextCloud
  • Matrix
  • HomeAssistant
  • etc.

Right now every family member needs to create a user on each of those services and have a different password on them, which is OK when you use a Password Manager, but most of my extended family members don’t. And they often forget their password and stop using the service because they can’t figure out how to reset the password with each and every service.

I would like to try to consolidate all of it with a Single Sign-On (SSO) solution but It’s not obvious to me if there is one which is not overly over engineered for hundreds of thousands of users but small and lightweight, perhaps even easy to set up.

I tried OpenLDAP but Jesus that was very involved.

@[email protected]
link
fedilink
English
272Y

Keycloak is decent. It has its own built in user database, or it can connect to an “upstream” idp like AD, GitHub, google, fb, basically anything that speaks openid or SAML. Then, it can act as an idp to each service you run. It is a bit of a chore to configure, but compared to other SSO servers it’s pretty good (looking at you shibboleth)

@[email protected]
link
fedilink
English
72Y

After about a year of using Keycloak for some #dayjob side projects, I literally just stood it up in my homelab.

It does have a learning curve, but it supports OIDC and SAML - those two should get most internal services covered.

Back end can federate with AD or LDAP - for the real stinkers who refuse to support SSO. (Looking at you Netbox)

@[email protected]
link
fedilink
English
22Y

Lol, our main initiative at work right now is migrating our on prem auth to keycloak.

@[email protected]
link
fedilink
English
32Y
@[email protected]
link
fedilink
English
32Y

I’m using Authentik with openID or saml for all my sso. I don’t want to ever touch LDAP.

chiisana
link
fedilink
English
32Y

I started trying out FusionAuth and it’s been pretty neat. I off-load my auth to Google because I don’t want yet another username/password nor do I want to be responsible in storing it, but you can certainly use built-in auth if your objective is to stop using external auth. I currently have my Kasm Workspace deployed behind it, so when user lands on Kasm, they get bounced to FusionAuth where there’s a login prompt and Login w/ Google button; when they authenticate (be it through built-in auth or Google in my case), they get bounced back to Kasm Workspace in their account. This was deployed using docker compose, so I just annotate containers I want to protect w/ some labels, traefik handles all the glue work. I really like the way it worked out.

I’d imagine something like Authelia, which gets pushed a lot as well, would be able to offer a similar if not identical workflow.

For Lemmy, at this time, I don’t think it is possible to gate it like that, otherwise inbound federation (i.e.: comment replies to this post) won’t make it into your instance.

@[email protected]
link
fedilink
English
22Y

I use Keycloak and OpenLDAP, but if I was setting it up again I’d probably just use Authentik

Jeena
creator
link
fedilink
English
32Y

So I was able to test NextCloud as the provider with PeerTube as the client and it works but there is no way to connect this new login with a already existing user which is terrible 😭 . To get this working I would need to create new users and then move all the videos to those new users.

I gues this problem exists with every of those services which my family already has in use … so it’s mostly practical for new services I guess?

nakal
link
fedilink
12Y

I used plain Kerberos. I stopped, because sometimes I don’t want to be logged in automatically. Privacy and multi-account systems get more difficult.

loke
link
fedilink
1
edit-2
2Y

Same. I still use Kerberos, but I use kinit manually when I want to authenticate. It does force me to type the password more often but the benefits outweigh that.

Ananace
link
fedilink
English
12Y

Personally using Dex, it’s about as lightweight as you can get, it can be configured with a single configuration file on disk, and it runs entirely stateless as well.

It only deals with authentication delegation though, unlike larger systems like Keycloak.

@[email protected]
link
fedilink
English
72Y

Following since I’m new to Lemmy and not sure how to or even if I can save a post. I too am looking for something. I spun up authentik but was quickly overwhelmed with what to do after that, lol. I made it as far as logging in then got…lost no matter what tutorials I tried to follow.

@[email protected]
link
fedilink
English
12Y

https://cosmos-cloud.io/

Maybe try this ? Looks to be focused on simplicity and ease of use.

Outcide
link
fedilink
English
62Y

At the moment I only use lldap. I’ll probably add Authelia at some point …

@[email protected]
link
fedilink
English
112Y

I started integrating Authentik lately based on seeing people recommend it. It has pretty steep learning curve. I had to follow tutorials and even then each integration have its own quirks. I got stuck on integrating my internal e-mail server with ldap provider (via authentik). It’s definitely capable but it’s a project to integrate all services.

@[email protected]
link
fedilink
English
3
edit-2
2Y

Other SSO options are just a tough if not more complex than authentik. If you use docker and are self hosting, this is a great option. Provides basically every SSO option to connect all your services, especially if you combine it with a good reverse proxy like traefik to provide SSO to simple webapps.

If you are setting up a self hosted infrastructure and have some experience, I highly recommend checking out techno Tim’s “ssl everywhere” video for wild card ssl with traefik and then combine that with authentik for SSO with both local only and internet accessible apps.

@[email protected]
link
fedilink
English
32Y

I really like Authentik after using keycloak for quite a while.

@[email protected]
link
fedilink
English
12Y

How would you compare it ?

gabe565
link
fedilink
English
12Y

+1 for Authentik! It definitely has a steep learning curve, but once you get comfortable with it, it’s really versatile. The integration docs have tons of walkthroughs for setting up Authentik with different apps which is epecially helpful when getting started.

nickwitha_k (he/him)
link
fedilink
English
72Y

I’d suggest something like Keycloak or earning the wizard robe and beard by buckling down and learning OpenLDAP. The biggest suggestion that I have though is to have a disaster recovery plan for even your auth system goes down. Don’t be like Facebook and lock yourself out without any hope of regaining entry (or, if you’re a fan of Russian Roulette, do).

@[email protected]
link
fedilink
English
22Y

What I would dearly like is an SSO system that can also act as a drop-in replacement for Kerberos. Existing krb5 servers (on Linux) are ancient, quirky, and underdocumented, but kerberos is so useful at a CLI level. I’ve always maintained separate LDAP & Kerberos instances, and the thing stopping me from moving to something more modern is that I’m holding out for that kerberos feature…

@[email protected]
link
fedilink
English
72Y

I’ve found Zitadel to be the best open source Oauth2 provider. It also supports terraform for a fully IaC approach to declaring your users and their permissions.

@[email protected]
link
fedilink
English
3
edit-2
2Y

I can only support that. This is what I am running for my small business as well and it’s been super smooth for roughly a year now! Especially self service and auto-registering based on domain names turned out to be really nice features (for a business). In my homelab I just enjoy having a nice ui.

https://github.com/zitadel/zitadel

https://zitadel.com/

I came from Authentik which was nice too but nowhere as feature rich as zitadel.

philwinder
link
fedilink
42Y

Might not be quite what you want, but if you just need to block all access to everything unless logged in, then integrating a hosted SSO into your ingress is a simple, low management option.

I’ve been using an old trafeik setup with Google’s SSO, whitelisting certain accounts, and had no problems with it for years.

Create a post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

  • Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
  • No spam posting.
  • Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
  • Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
  • No trolling.

Resources:

> Any issues on the community? Report it using the report flag.

> Questions? DM the mods!

  • 1 user online
  • 218 users / day
  • 9 users / week
  • 244 users / month
  • 841 users / 6 months
  • 0 subscribers
  • 542 Posts
  • 8.93K Comments
  • Modlog