Top all-time · #3744
Gluu
Company blog · gluu.org/blogsecuritysystems
Gluu is the company blog at gluu.org, writing about security and systems. Since 2011, 21 different Hacker News readers have linked it 47 times, most often “Gluu – Open-Source Digital Identity and Access Management”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN commenters mention Gluu as an open-source identity server alternative to Keycloak and similar tools. One commenter links its OAuth vs SAML vs OpenID Connect comparison as a learning resource.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Measure risk, transparency and accountability with declarative policies, formal analysis, explicit federation and continuous compliance.
Most-linked posts?
- Gluu – Open-Source Digital Identity and Access Management8 people · 8 mentions · first linked 2019-07-01
- Centos Linux is Dead: A warning to the KeyCloak community3 people · 3 mentions · first linked 2020-12-13
- How to *securely* use SMS two-factor authentication (2FA)2 people · 2 mentions · first linked 2018-02-15
- /2 people · 2 mentions · first linked 2021-11-24
What Hacker News says?
I would be careful depending on Keycloak given what happened with CentOS recently: - https://www.gluu.org/blog/keycloak-is-the-next-centos/
Comment linking /blog/keycloak-is-the-next-centos/
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Submitted Gluu vs. Keycloak (2018) as a story · 29 points
HN discussionNow is probably a good time to plug some of the open source alternatives to vendor locked in identity solutions: - https://github.com/ory - https://github.com/dexidp/dex - https://github.com/authelia/authelia - https://github.com/keycloak/keycloak - https://www.gluu.org/ - https://github.com/accounts-js/accounts
Comment linking /
on “AWS Cognito is having issues and health dashboards are still green”Submitted How to *securely* use SMS two-factor authentication (2FA) as a story · 6 points
HN discussionIt can be easier to extend & customize[0] though. I went with IdentityServer4 on a recent project over Keycloak and Gluu[1] for that reason and because it was in the same stack as the rest of our ecosystem. [0] See comment from this thread https://news.ycombinator.com/item?id=22871756 [1] https://www.gluu.org/
Comment linking /
on “Keycloak: Open-source identity and access management”Submitted How to Secure API’s as a story · 4 points
HN discussionI've been considering setting up a Gluu [1] instance for some of my services. It supposedly supports LDAP as well as OpenID and Oauth2 for authentication as well as RADIUS. From what I can tell, this would fit your use case perfectly fine. It's available as open source software but the company behind it is selling it as well in case you'd like a support contract. Note that I haven't set it up myself yet, it's still…
Comment linking /
on “Keycloak: Open-source identity and access management”Submitted Utility Tokens: A new funding model for open source enterprise software startups as a story · 4 points
HN discussionPersonally I think of Authelia and Keratin as really good projects in the don't-build-auth-into-your-apps-ever-again space. If auth isn't already built into your app gateway/mesh/proxy, then these services might be something worth dropping alongside. A few more projects in this space: - Keycloak (you won't get fired for picking this)[0] - CloudFoundry's UAA[1] - Gluu [2] - ORY (Hydra + friends)[3] - Keratin [4] - Op…
Comment linking /docs/gluu-server/4.2/
on “Authelia is an open-source authentication/authorization server with 2FA/SSO”Submitted Part II: Beware of a Microsoft-Google Internet Security Oligarchy as a story · 4 points
HN discussionIt includes an LDAP server to persist all the data generated by the service. You can integrate your own backend LDAP server using the cache refresh feature: https://gluu.org/docs/ce/admin-guide/user-management/#ldap-s... It is pretty beefy though, built for enterprise use cases.
Comment linking /docs/ce/admin-guide/user-management/
on “Run your own OAuth2 server”Submitted Wil 3PCD Break the Web? Browsers to Block 3rd party cookies one day in 2023 as a story · 3 points
HN discussionGluu Server supports U2F out of the box: https://gluu.org/docs/ce/authn-guide/U2F/ Installation instructions: https://gluu.org/docs/ce/installation-guide/
Comment linking /docs/ce/installation-guide/
on “Run your own OAuth2 server”Submitted Gluu – Open-Source Digital Identity and Access Management as a story · 3 points
HN discussionThis introduction is pretty simple and concise to just understand what it is: https://www.cloudflare.com/learning/access-management/what-i... Follow that up with this SAML and OAuth comparison: https://www.ubisecure.com/uncategorized/difference-between-s... Then see how OpenID Connect fits in: https://www.okta.com/identity-101/whats-the-difference-betwe... https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/ A…
Comment linking /blog/oauth-vs-saml-vs-openid-connect/
on “Everything you need to know about OAuth 2.0”Submitted Centos Linux is Dead: A warning to the KeyCloak community as a story · 3 points
HN discussionhttps://identityserver.io/ https://fusionauth.io/ https://www.keycloak.org/ https://www.gluu.org/ Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.
Comment linking /
on “Show HN: Hydra – Open-Source OAuth2 Server”Submitted How to *securely* use SMS two-factor authentication (2FA) as a story · 3 points
HN discussionMy partner Mike Schwartz founded Gluu because he was tired of recommending proprietary access management platforms like Siteminder and IBM Tivoli that were locked behind six figure licenses. We're now a team of about 30 people with 10 years of development into the Gluu Server, a free open source software platform for SSO, 2FA, access management: https://gluu.org/docs/ce
Comment linking /docs/ce
on “Ask HN: Who are some unsung heroes in open source that need more support?”Submitted Gluu Server – identity and access management (IAM) platform as a story · 3 points
HN discussionBeen there, done that - wish it upon no one. If anyone ever brings up the idea of building out oauth or even vaguely user management, I try to point them to at least try a POC (Proof of Concept) with https://www.keycloak.org/ (Apache 2.0 License) or https://www.gluu.org/ (MIT License) before they considering building.
Comment linking /
on “How Shopify implemented its secure authentication service”Submitted Is Google getting ready to buy Okta? as a story · 3 points
HN discussionHow do I find that discovery endpoint, given your email address @gluu.org? https://gluu.org/.well-known/openid-configuration doesn't exist. I don't even know that idp.gluu.org is a thing from your email address.
Comment linking /.well-known/openid-configuration
on “Stack Overflow: Support for OpenID Ends on July 1, 2018”Submitted Decentralized Identity: A hype-free summary (Part I) as a story · 2 points
HN discussionNo, OpenID has been replaced by OpenID Connect, a profile of OAuth 2.0 written to specifically address user sign in. OAuth 2.0 is an authorization framework, not an authentication protocol. OAuth 2.0 can be used for a lot of cool tasks, one of which is person authentication. OpenID Connect is a “profile” of OAuth 2.0 specifically designed for attribute release and authentication. For more info, see our blog: OAuth v…
Comment linking /resources/documents/articles/oauth-vs-saml-vs-openid-connect/
on “Stack Overflow: Support for OpenID Ends on July 1, 2018”Submitted Centos is Dead is Keycloak next? as a story · 2 points
HN discussionThere's been some discussion regarding the merits of using JWT's (JSON Web Tokens) instead of Connect. Mike added some clarification in the form of a comment on the blog. I also added it here [1]. Feel free to join the discussion on the blog.[2] [1] https://news.ycombinator.com/item?id=13134752 [2] https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/#c...
Comment linking /blog/oauth-vs-saml-vs-openid-connect/
on “OAuth vs. SAML vs. OpenID Connect”Submitted 1B OpenID Authns/Day Benchmark Details with K8 Autoscaling as a story · 2 points
HN discussionMike replied to a comment about JWT's on the blog. Figured I'd also add it here for good measure. Feel free to continue the discussion in the comments section of our blog.[1] " JWT's are great. That's why they are used extensively in the OpenID Connect spec. The question is what's in that JWT? What are the claims? How do you know that the JWT that you got back in the response relates to the request you sent (i.e. Co…
Comment linking /blog/oauth-vs-saml-vs-openid-connect/
on “OAuth vs. SAML vs. OpenID Connect”Submitted Gluu: Open-Source IAM / SSO as a story · 2 points
HN discussion
