162
What Self-Hosted Single Sign-On (SSO) do you use?
(jemmy.jeena.net)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 21 Jul 2023
162 points (99.4% liked)
Selfhosted
40347 readers
217 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
I'd suggest something like Keycloak or earning the wizard robe and beard by buckling down and learning OpenLDAP. The biggest suggestion that I have though is to have a disaster recovery plan for even your auth system goes down. Don't be like Facebook and lock yourself out without any hope of regaining entry (or, if you're a fan of Russian Roulette, do).
What's your DR plan? My "plan" is to SSH in and figure out what's wrong.
I'm still trying to cover up with a good one to allow more self-hosting. Probably a SHTF security key kept in a safe that can be used with physical access.
The problem here being that you have a circular dependency:
My SSH auth uses SSH keys stored in authorized_keys, but I see your point. For me, OpenLDAP will be letting users in to the various services and SSH is outside that. I suppose SFTP could be something I want, but I'd be tempted to put a new sshd inside a container and have it more restricted than the system one.
I think the backup key idea is definitely the most broadly applicable, but there's physical/KVM for a more old school access route.
That makes sense. I like the idea of combining physical key with physical/KVM access so that there is no password auth (at least, not without a second factor).