obligator

From what I can tell, Ory is a high quality auth stack capable of scaling up. If you're looking for something a bit simpler to work with for indiehosting use cases, I maintain a list here: https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...

To replace Auth0/Okta you really need something like Passport.js and something like Keycloak. I maintain a decent list of Keycloak alternatives here: https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...

I have a comparison table here: https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...

I maintain a reasonably good table of the open source options here: https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...

I'm sensing a shift in the auth space. This is my very rough impression: ~20 years ago everyone rolled their own auth. ~15 years ago libraries like Passport started cropping up and gaining in popularity. I would guess this is when people started preaching "don't roll your own auth". ~10 years ago OAuth2/OpenID Connect became popular for UX reasons but only for centralized social login providers ~5 years ago Auth0/Okta was all the rage, though this is likely an HN ecochamber and maybe limited to enterprise. The last few years it seems like self hosting is getting more popular, perhaps due to increased quality in open source offerings (Zitadel, Ory stack, many others[0]). And very recently[1] there's been some excellent resources like OP focused more on teaching you how to roll your own again, incorporating the security lessons of the past

This is pretty nice. I see sish and inlets. I have a lot more similar tools on my list here: https://github.com/anderspitman/awesome-tunneling For auth, I also made a comparison of OIDC servers here: https://github.com/lastlogin-net/obligator#comparison-is-the...

The deployment experience is awesome, but for me[0] the killer feature of Fly.io is their Anycast network and features such as FLY_REPLAY and LiteFS that make clusering a breeze[1]. It's wild to me how little support VPS providers have for reducing latency of backend services for users. None of them support Anycast, and there are very few GeoDNS options (it adds more complexity besides). I just wish Fly.io had cheaper data transfer, since I'm currently having to re-implement (poorly) a lot of their features for an ngrok-like service I'm working on. [0]: using them for https://lastlogin.io [1]: Here's all the fly-specific code necessary to run LastLogin in a globally distributed way: https://github.com/lastlogin-io/obligator/blob/37f75cc861f1b...

I'd recommend a reverse proxy and login server using "forward auth". I made a list of such login servers here: https://github.com/lastlogin-io/obligator?tab=readme-ov-file...

I use obligator with ephemeral storage, no db, 100% code driven setup. In my opinion this is the simplist option. https://github.com/lastlogin-io/obligator

I made a (incomplete) comparison table of various self-hostable OpenID Connect servers[0]. One of the surprising things to me is just how massive the Keycloak codebase is. [0]: https://github.com/lastlogin-io/obligator?tab=readme-ov-file...

I made a (rather incomplete) comparision of various OpenID Connect server implementations[0]. Keycloak has over 1M lines of code. LOC isn't everything, but I don't know how you're supposed to avoid a decent number of serious vulnerabilities with that much surface area. [0]: https://github.com/lastlogin-io/obligator#comparison-is-the-...

There was a recent discussion on Obligator recently, I did not test it. But they have a nice table with a list of providers : https://github.com/lastlogin-io/obligator#comparison-is-the-...

See the table here: https://github.com/lastlogin-io/obligator#comparison-is-the-...