Keycloak alternative

[adel-chouchane]

Hello,
Is it possible to use an identity access manager besides Keycloak ?

[EricWittmann]

Currently Apicurio Studio is rather coupled with Keycloak. It should be possible to use a different IDP for the backend easily enough. I'm not 100% but I think the UI layer is coupled with Keycloak (we use keycloak's javascript library to support logins). We have support for non-keycloak logins in Apicurio Registry, so I imagine we could port that work over to Apicurio Studio as well if we haven't yet (WDYT, @carlesarnal ?)

However, all of Studio's git integration features are heavily reliant on Keycloak to work. So those features will definitely not work with a different IDP.

What I believe you can do is use Keycloak to federate/proxy to another IDP. So you could install Keycloak but configure it to use another IDP as the source of identity and roles. Not ideal but I think that's possible.

[carlesarnal]

Studio UI is also very tied to Keycloak. We can probably port the work from Registry but it would cover only a small subset of studio functionalities, I'm afraid.

[CleverCoder]

Why does an open-source API authoring tool need to be coupled to an identity provider?

[EricWittmann]

Whoa long wait for an answer to this one. :) The answer is that the GitHub/GitLab/Bitbucket integration depends on some Keycloak specific functionality - specifically using OAuth to link your git account (from one of the above providers) to your Keycloak account. This allows Studio to make API calls to the git providers without having to manage your credentials or a PAT.

If I had to implement it again, I would probably think about just managing a PAT, but doing so opens up the application to a lot of security concerns, which is something that Keycloak already has to deal with.