Need advice about which tool to choose?Ask the StackShare community!
DID vs Keycloak: What are the differences?
Introduction:
In the world of authentication and access control, two popular technologies are Decentralized Identifiers (DID) and Keycloak. While they both serve the purpose of providing secure and reliable user authentication, there are several key differences between them. In this article, we will explore these differences in detail.
Authentication Approach: DID is a decentralized approach to authentication, where each user has their own unique identifier that is not controlled by a centralized authority. On the other hand, Keycloak is a centralized identity and access management tool that uses standard protocols like OAuth2 and OpenID Connect for authentication.
Scalability and Flexibility: DID allows for a highly scalable and flexible authentication system, as each user has their own DID that can be used across multiple platforms and applications. Keycloak, on the other hand, provides a centralized solution that may be more suitable for smaller-scale applications or organizations that require strict control over user authentication.
Privacy and Control: With DID, users have more control over their personal data and can choose what information they want to share with others. Keycloak, being a centralized system, may require users to provide more personal information and rely on the organization's policies for data privacy and control.
Interoperability: DID offers interoperability by allowing users to authenticate across different systems and applications using their DIDs. Keycloak, with its standardized protocols, also provides interoperability but may require more configuration and integration efforts.
Community and Support: DID is a relatively new technology and may have a smaller community and support compared to Keycloak, which has been in development for a longer time and has a larger user base and community. Keycloak offers extensive documentation, forums, and support channels to assist developers and administrators.
Customization and Extensibility: Keycloak provides various extensions and plugins that can be used to customize and extend its functionality according to specific requirements. DID, being a decentralized approach, may have limited options for customization and extensibility.
In summary, the key differences between DID and Keycloak lie in the authentication approach, scalability and flexibility, privacy and control, interoperability, community and support, and customization and extensibility. DID focuses on decentralization and user control, while Keycloak offers a centralized and customizable solution with a larger community and support base.
I am working on building a platform in my company that will provide a single sign on to all of the internal products to the customer. To do that we need to build an Authorisation server to comply with the OIDC protocol. Earlier we had built the Auth server using the Spring Security OAuth project but since in Spring Security 5.x it is no longer supported we are planning to get over with it as well. Below are the 2 options that I was considering to replace the Spring Auth Server. 1. Keycloak 2. Okta 3. Auth0 Please advise which one to use.
It isn't clear if beside the AuthZ requirement you had others, but given the scenario you described my suggestion would for you to go with Keycloak. First of all because you have already an onpremise IdP and with Keycloak you could maintain that setup (if privacy is a concern). Another important point is configuration and customization: I would assume with Spring OAuth you might have had some custom logic around authentication, this can be easily reconfigured in Keycloak by leveraging SPI (https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi). Finally AuthZ as a functionality is well developed, based on standard protocols and extensible on Keycloak (https://www.keycloak.org/docs/latest/authorization_services/)
You can also use Keycloak as an Identity Broker, which enables you to handle authentication on many different identity providers of your customers. With this setup, you are able to perform authorization tasks centralized.
We have good experience using Keycloak for SSO with OIDC with our Spring Boot based applications. It's free, easy to install and configure, extensible - so I recommend it.
Pros of DID
Pros of Keycloak
- It's a open source solution33
- Supports multiple identity provider24
- OpenID and SAML support17
- Easy customisation12
- JSON web token10
- Maintained by devs at Redhat6
Sign up to add or upvote prosMake informed product decisions
Cons of DID
Cons of Keycloak
- Okta7
- Poor client side documentation6
- Lack of Code examples for client side5
