ZITADEL Blog

Excellent writing and diagrams!

If you want to expand your knowledge beyond OAuth2 (and most probably you should if you want to design systems used by big guys from 0 to 1) , highly recommend to jump straight into OpenID Connect (OIDC) which is an identity layer built on top of OAuth 2.0.

Besides reading specs, Sascha Preibisch's videos on both OIDC and OAuth2 were the most useful to solidify a bigger picture for me

https://www.youtube.com/@saschazegerman/playlists

Specs are actually well written despite of all jargon and train of buzzwords used inside. The most annoying on my list are OP (OpenID Provider) and RP (Relying Party) ...

https://openid.net/specs/openid-connect-core-1_0.html

https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/

Most useful knowledge however personally gained from studying ORY Hydra mentioned in the article and Zitadel

https://zitadel.com/

The problem with OIDC and OAuth2 space - IDP providers are too "creative" in their interpretation of specs starting from userinfo and token exchange endpoints.

Without allocating significant amount of time getting all flows and related cyberops into your brain might never happened.

Good news - it's a life time investment ...

Oidc search on github gives good results - libraries, open source IDPs, all kind of proxies, etc

https://github.com/topics/oidc

When I was building a website and companion app, I researched a lot of the open-source options for auth. My primary requirement was ease of setup and operation. I didn't want to mess around with JVM dependencies and 100% didn't want to start messing around with k8s for such a small project.

I was also very intimidated by the ORY stack. I didn't know how all the pieces fit together. And to self-host you pretty much need to run and orchestrate it on k8s. I'm not an auth expert, I just want a login thingy for my website/app.

I'm not affiliated with it in any way, but I really liked what ZITADEL[1] is doing, in case anyone else is researching their options. It has a very simple interface to get started with, but also a ton of features. It being written in Go is a huge benefit since that makes it much easier for me to throw it up on my vps and calling it a day.

1. https://zitadel.com/

> Keycloak is a great tool but definitely not has B2B features like user management for each business customer, self service and delegated access management as well as self service federation.

(See also: https://zitadel.com/blog/zitadel-vs-keycloak)

I might be misreading your post and/or the linked blog post, but I got the impression that both assume that different business customers will share the same KC realm and will only be divided by groups/roles/etc. Is that correct?

We use Keycloak in a multi-tenant scenario, so each new business customer spawns its own realm, meaning it can have a fully independent configuration (SSO, OAuth2 integration, 2FA, roles, etc.). While we provide a simplified UI in our product, a sufficiently technical customer can in principle be granted a realm-level administrator user to manage their own configuration.

I found Nate Barbettini's video on OAuth and OpenID Connect incredibly insightful for understanding these topics. He explains everything so well- https://youtu.be/996OiexHze0.

Additionally, I'm part of the ZITADEL team, an open-source project that's free to download or use in our cloud offering. So, you can always tinker around with it as some others have already suggested. Our blog dives into various security topics, ranging from OAuth, OpenID Connect, and Single Sign-On, Authentication, Federation to emerging issues like Passkeys. We also discuss real-world Identity Management problems and solutions seen by ZITADEL users— https://zitadel.com/blog.

For any specific security-related queries, feel free to join the conversation on our Discord chat: https://zitadel.com/chat. We're always discussing and sharing insights on these topics.

Zitadel co-founder here.

We support multiple approaches for multi-tenancy.

In a typical setup you will only need an instance (a virtual Zitadel system).
This already supports B2C and B2B deployments.

If you want to host multiple customers, fully isolated, you could create an instance for each customer. However this is only necessary if you want to become a Zitadel service provider in most cases ;-)

Some docs for this:

Organization vs Instance: https://zitadel.com/blog/multi-tenancy-with-organizations
Instance: https://zitadel.com/docs/concepts/structure/instance
Organization: https://zitadel.com/docs/concepts/structure/organizations

Hope this helps!

Curious. I'm not using Zitadel yet, but we are planning to. It seems to support all of those features. What was the missing part for you?

https://zitadel.com/docs/apis/saml/endpoints

https://zitadel.com/docs/guides/integrate/identity-providers/ldap

https://zitadel.com/docs/concepts/features/selfservice#mfa--2fa

https://zitadel.com/docs/guides/migrate/introduction#multi-tenancy-architecture

https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhosting