Is self-hosting my own OpenID server possible? reddit / selfhosted ---------------------------------------------------------------------- LearningToad · 2023-12-26 11:34 Hello, I would like to create my own SSO login using OpenID. The goal is to: host my own authentication server (OpenID), and the different apps that I own will have a single, unified sign on. There are not much resources online and most people are saying to use Auth0 etc. How should I go about to get started? I know people advise against building your own auth system, but is this considered doing so? I always thought we're using the OpenID convention of sort and it's not creating my own auth system. ---------------------------------------------------------------------- Sworyz · 2023-12-26 11:57 I guess you may be looking at Authentik or maybe Authelia ? Also keycloack but a bit more hard to setup. ---------------------------------------------------------------------- znpy · 2023-12-26 12:44 we did that in my previous job, by running Keycloak. I tried running keycloak at home and it works, but i didn't want to manage it. I did try using https://www.cloud-iam.com/ (they have a nice free tier which is very good for low volume and if you don't care about things like custom html themes) and it works very well. ---------------------------------------------------------------------- NobodyRulesPenguins · 2023-12-26 14:23 That depend on what you have in place. But I know that Gitea can be used as an OpenID provider. Maybe it's community can tell you more about it and similar services? Looking at [alternativeto](https://alternativeto.net), when I search for OpenID directly and look at the self-hosted open-sources alternatives. Portier and IndieAuth came up. Maybe one of them can be of use to you **Edit**: looking at them a little more and they arent provider, too bad :( ---------------------------------------------------------------------- YaneonY · 2023-12-26 15:24 Look at Zitadel. Nice one and you can selfhost. ---------------------------------------------------------------------- erik_b1242 · 2023-12-26 15:37 +1 For Authelia, use it with LDAP for creating/managing users/groups, and use it's SSO for all the apps that support OpenID, ibracorp has good guides for setting up Authelia, and Authelias OpenID docs are good, with even some exampme integrations, like Portainer ---------------------------------------------------------------------- Scot_Survivor · 2023-12-26 16:26 Zitadel is cool, but after using it and experiencing issues with support, SAML and the weirdness that it does (like not supporting flat roles as standard). I switched back to Keycloak. ---------------------------------------------------------------------- Cyberz0id · 2023-12-26 16:33 I went with https://goauthentik.io/. It's an OIDC server that can federate with Google (and others). The big thing for me is that it's also a Ldap provider for apps like Jellyfin. Next it has a built in proxy for apps with no authentication. It's very similar to Keycloak ---------------------------------------------------------------------- YaneonY · 2023-12-26 16:43 Support is good. You can always get help on discord. ---------------------------------------------------------------------- Max-_-Power · 2023-12-26 19:27 I'm self-hosting many apps and I'm using KeyCloak for SSO. It's pretty solid so far but it won't hold your hands configuring it. ---------------------------------------------------------------------- SkybertNO · 2023-12-26 19:44 I am a bit biased, but AzureAD free tier is very generous. Especially on the B2C stuff ---------------------------------------------------------------------- EnumeratedArray · 2023-12-26 20:04 Check out Azure AD, you get a very good system for free ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-26 20:23 Authentik, authelia, keycloack, zitsdel ---------------------------------------------------------------------- readymix-w00t · 2023-12-26 20:31 ForgeRock used to have a community "backstage" versions of OpenIDM/AM/DJ available for free. They still are, but they're not on the Forgerock site anymore. OpenAM and OpenDJ should get you where you want to go. And I believe they package them up for docker container use if you want to get started quick and easy. ---------------------------------------------------------------------- emprahsFury · 2023-12-26 21:18 Authelia just hit 1 year of no releases, not even maintenance, so while the devs are still making commits, opening/closing issues; I'm not convinced we should be recommending it in the unmaintained state that it's in. ---------------------------------------------------------------------- sir_dancealot · 2023-12-26 21:21 The Ory stack is favorite. I believe Hydra is the OAuth and OpenID- compatible auth server. Keto is the login and identity server, and there are a few other components you can use or not use ---------------------------------------------------------------------- Sworyz · 2023-12-26 21:40 Good to know that. Thanks. I use Authentik mostly so didn't check often Authelia. ---------------------------------------------------------------------- Reverent · 2023-12-26 21:50 Keycloak isn't difficult to set up, or at least not significantly harder than other Auth solutions: https://blog.gurucomputing.com.au/Au thentication%20with%20Keycloak/Authentication%20with%20Keycloak/ I know we like to jump onto hobby projects in this place, but your identity provider is not something to YOLO. ---------------------------------------------------------------------- Ill-Engineering7895 · 2023-12-27 00:59 If you already use or self-host Gitea, it can also be used as an OIDC provider itself. ---------------------------------------------------------------------- mcmnio · 2023-12-27 10:24 You're right: "don't build your own auth system" doesn't apply here. You're not *building* the auth system, you're just hosting it. I've set up Authentik myself to use with a few self-written applications. Works as expected, plugged right into my OpenID Connect implementation. ---------------------------------------------------------------------- jogai-san · 2023-12-27 15:11 https://docs.logto.io/docs/tutorials/get-started/#local ---------------------------------------------------------------------- Scot_Survivor · 2023-12-27 20:58 Just wasn’t for me. Lacking features in certain ways too. LDAP sync was broken for me and no one seemed to know about it :( ---------------------------------------------------------------------- Sworyz · 2023-12-28 11:54 I just tried to set it up and there is only one thing I can't make work : restrict clients/apps to only some users or groups like Authentik. Except that yes, you are true, it isn't that hard to setup as everyone (and I) said. ---------------------------------------------------------------------- zeta_cartel_CFO · 2023-12-28 12:39 whoa. I did not know this. Is there any documentation on how to configure it as a OIDC provider? ---------------------------------------------------------------------- Ill-Engineering7895 · 2023-12-29 09:00 Its great, I use my gitea as my single sign on for everything. Gitea does a lot more than host code. It also serves as a private docker container registry, or a private npm package registry.