7 ms·

Simplify Login with Application Load Balancer Built-In Authentication

93 points by wanghq 8y ago

TruffleMuffin 8y ago
I am genuinely amazed by the stuff Amazon does sometimes. There are many times this would have made my life so much easier. Feels like cloud providers are becoming more like language frameworks over time. I guess its a kind of lock in, but no more than your locked into .NET Framework or Boost or Underscore I suppose.
- fahrradflucht 8y ago
  I'm a big fan of this stuff myself so don't get me wrong, but I think it is still a little bit worse to be locked into a cloud provider which can change rates/pricing on you any time, then being locked into a framework.
  - napsterbr 8y ago
    > which can change rates/pricing on you any time, then being locked into a framework. I absolutely agree with the sentiment, so don't get me wrong, but have any cloud provider ever did so? And most importantly, given that such change would impact user confidence, would it really be worth on the long term? Of course there are several other reasons to avoid vendor lock-in, but as far as "major bad faith pricing change" goes, I believe it's unlikely.
    - napsterbr 8y ago
      Ah, I'd like to prove myself wrong in less than one minute: gcp's pricing change on maps services.
    - StreamBright 8y ago
      Or fuel provider, ISP, water and other utilities and so on. So many vendor lock ins, so little time.
    - jonny_eh 8y ago
      I recall Google App Engine jacking up their prices: http://highscalability.com/blog/2011/9/7/what-google-app-engine-price-changes-say-about-the-future-of.html http://highscalability.com/blog/2011/9/7/what-google-app-eng...
- notaspider 8y ago
  Yes I can see this being a turn off for people who don't want to be married to AWS but I know I will be giving it a go myself
go_prodev 8y ago
This looks really interesting. On one of my sites I tried integrating Cognito and was not smart enough to get it working. This seems fairly easy by comparison.
- appwiz 8y ago
  (Disclosure: Lead for AWS Amplify, amongst other products) Try AWS Amplify (https://aws.github.io/aws-amplify/media/authentication_guide https://aws.github.io/aws-amplify/media/authentication_guide) to set up Cognito for your site. Let us know if it still didn’t work - we’d love to help.
i_have_to_speak 8y ago
Is this similar to GCP's "Cloud Identity-Aware Proxy"? [1] https://cloud.google.com/iap/ https://cloud.google.com/iap/
- ertand 8y ago
  I think the main difference between the two is, IAP aims to replace VPN requirements for Enterprises. It only integrates with Google accounts and it seems to go hand in hand with GSuite. So they are more B2B oriented. We hide our staging servers behind IAP for instance. Amazon's solution seems to integrate with a few other identity providers and gives the developers the tools to do authorization after authentication is done. It seems to position this more like a B2B2C. Although it feels like it already subsumes Google's IAP by doing so. This is my understanding by reading the article on Amazon, I haven't actually used it.
momania 8y ago
This is nice, but how about a simpler feature for the ALB: redirect http to https.
- tachion 8y ago
  This is probably missing because it's dead simple to solve on the application/infrastructure side by sending 302 or even 301 if you don't really miss the HTTP. For things like that, that are very easily solvable other way I don't expect Amazon to work on them anytime soon, if ever.
  - momania 8y ago
    It's easy to solve in the application, but then I need to have an http and https endpoint in my application, just for this redirect, already behind the ALB. I mean, if they can build in authentication redirects on the load balancer, how hard is it then to add a simple http -> https redirect, so this http traffic never has to 'touch' my application.
    - jnsaff2 8y ago
      Well you don't need to have two listeners, you just need to check "X-Forwarded-Proto" header and if it's not "https" then do the redirect. I think checking that header is a good idea anyway for something sensitive. Also if you use API GW/CloudFront they would do that for you too.
  - vegardx 8y ago
    I think it's more likely that they want to differentiate LBs and CloudFront, feature wise. It would make sense to do it in the load balancer, you want to do the redirect as soon as possible. So if you want to do it the correct way you get the option of paying for both ALB and CF.
- jdub 8y ago
  Add CloudFront, then your CloudFront-provided TLS termination AND redirect will be much closer to the client.
MightySCollins 8y ago
I have spent all morning trying to get this to work. What seems to suck is your ALB will return an error with no details.
timrichard 8y ago
Looks interesting. Although the example has a TTL of 7 days for the session cookie, which contains an identifier used by the service provider to uniquely fingerprint an individual user. Under GDPR, does all trace of a user have to be removed immediately on demand, even if this has been effectively delegated to something like the ALB?
- edf13 8y ago
  Don't think it states anywhere that all trace of a user have to be removed immediately on demand. Generally speaking you have 30 days to remove personal data (But there is a bit more to it than that). A good overview is from the UK ICO: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - bjpbakker 8y ago
    Also, it has to be technically feasible to remove the user data. So I don't think data stored on the client's own device is data that you necessarily should remove (though IANAL).
scwoodal 8y ago
How does one go about getting authentication like this working in a development environment?
- nzoschke 8y ago
  I do JWT token auth for apps as documented here: https://github.com/nzoschke/gofaas/blob/master/docs/security-cors-jwt.md https://github.com/nzoschke/gofaas/blob/master/docs/security... In dev I run the same exact code and copy the JWT cookie from my production site. Both dev and prod have the same secret to validate the cookie.
  - mkarazin 8y ago
    You probably are well aware, but security wise that's a huge issue. If it's a hobby app, okay, but anything with actual users should separate keys. The main concern would be that dev keys are not considered secure and anyone with access to the dev key could then impersonate any other user of the production application.
  - scwoodal 8y ago
    I wouldn't want to share keys like that. I'd also lose out on being able to modify my test account(s) with different groups/permissions that might not be in production yet.
nzoschke 8y ago
Does anyone on Heroku want similar functionality — a shared auth layer for many apps? I have an addon that puts CloudFront in front of you Heroku app with one click: https://elements.heroku.com/addons/edge https://elements.heroku.com/addons/edge I have been thinking about adding auth via Lambda@Edge... Now I have a nice implementation to copy...
- zie 8y ago
  or via HAProxy and hashicorp-vault I found this: https://github.com/csawyerYumaed/hapvault https://github.com/csawyerYumaed/hapvault
theseanstewart 8y ago
There is a missing link in the demo after logging in. 2nd paragraph says... > Click here to see what info was shared with this website after you authenticated.
kennydude 8y ago
I don't get why you'd use this over something like Python Social Auth which is debuggable, runs on any platform and lets you tweak it much much further :G
- bmelton 8y ago
  I assume it's for the same reason that people use services like Auth0 -- they don't want to waste development time programming all the fringe cases for authentication, when all they really care about is logging a user in and trusting that they are who they say they are. Some benefits: * Quicker to MVP * Don't have to rewrite AuthX for each platform (web, iOS, Android, etc) * Less worrying about the various permutations of 2-factor across all the applicable auth types (username, email, oauth, LDAP) * Not having to figure out how to federate identity * Not wanting the burden of GDPR/Privacy compliance in-app etc.
eganist 8y ago
Does Cognito still not support CAS for SSO? I'm not seeing any references to it via my google-fu. Quite a number of institutions in my vertical have focused on CAS as opposed to other protocols, hence the ask.

93 points by wanghq 8y ago

I am genuinely amazed by the stuff Amazon does sometimes. There are many times this would have made my life so much easier. Feels like cloud providers are becoming more like language frameworks over time. I guess its a kind of lock in, but no more than your locked into .NET Framework or Boost or Underscore I suppose.

fahrradflucht 8y ago
I'm a big fan of this stuff myself so don't get me wrong, but I think it is still a little bit worse to be locked into a cloud provider which can change rates/pricing on you any time, then being locked into a framework.
- napsterbr 8y ago
  > which can change rates/pricing on you any time, then being locked into a framework. I absolutely agree with the sentiment, so don't get me wrong, but have any cloud provider ever did so? And most importantly, given that such change would impact user confidence, would it really be worth on the long term? Of course there are several other reasons to avoid vendor lock-in, but as far as "major bad faith pricing change" goes, I believe it's unlikely.
  - napsterbr 8y ago
    Ah, I'd like to prove myself wrong in less than one minute: gcp's pricing change on maps services.
  - StreamBright 8y ago
    Or fuel provider, ISP, water and other utilities and so on. So many vendor lock ins, so little time.
  - jonny_eh 8y ago
    I recall Google App Engine jacking up their prices: http://highscalability.com/blog/2011/9/7/what-google-app-engine-price-changes-say-about-the-future-of.html http://highscalability.com/blog/2011/9/7/what-google-app-eng...
notaspider 8y ago
Yes I can see this being a turn off for people who don't want to be married to AWS but I know I will be giving it a go myself

go_prodev 8y ago

This looks really interesting. On one of my sites I tried integrating Cognito and was not smart enough to get it working. This seems fairly easy by comparison.

appwiz 8y ago
(Disclosure: Lead for AWS Amplify, amongst other products) Try AWS Amplify (https://aws.github.io/aws-amplify/media/authentication_guide https://aws.github.io/aws-amplify/media/authentication_guide) to set up Cognito for your site. Let us know if it still didn’t work - we’d love to help.

i_have_to_speak 8y ago

Is this similar to GCP's "Cloud Identity-Aware Proxy"? [1] https://cloud.google.com/iap/ https://cloud.google.com/iap/

ertand 8y ago
I think the main difference between the two is, IAP aims to replace VPN requirements for Enterprises. It only integrates with Google accounts and it seems to go hand in hand with GSuite. So they are more B2B oriented. We hide our staging servers behind IAP for instance. Amazon's solution seems to integrate with a few other identity providers and gives the developers the tools to do authorization after authentication is done. It seems to position this more like a B2B2C. Although it feels like it already subsumes Google's IAP by doing so. This is my understanding by reading the article on Amazon, I haven't actually used it.

momania 8y ago

This is nice, but how about a simpler feature for the ALB: redirect http to https.

tachion 8y ago
This is probably missing because it's dead simple to solve on the application/infrastructure side by sending 302 or even 301 if you don't really miss the HTTP. For things like that, that are very easily solvable other way I don't expect Amazon to work on them anytime soon, if ever.
- momania 8y ago
  It's easy to solve in the application, but then I need to have an http and https endpoint in my application, just for this redirect, already behind the ALB. I mean, if they can build in authentication redirects on the load balancer, how hard is it then to add a simple http -> https redirect, so this http traffic never has to 'touch' my application.
  - jnsaff2 8y ago
    Well you don't need to have two listeners, you just need to check "X-Forwarded-Proto" header and if it's not "https" then do the redirect. I think checking that header is a good idea anyway for something sensitive. Also if you use API GW/CloudFront they would do that for you too.
- vegardx 8y ago
  I think it's more likely that they want to differentiate LBs and CloudFront, feature wise. It would make sense to do it in the load balancer, you want to do the redirect as soon as possible. So if you want to do it the correct way you get the option of paying for both ALB and CF.
jdub 8y ago
Add CloudFront, then your CloudFront-provided TLS termination AND redirect will be much closer to the client.

MightySCollins 8y ago

I have spent all morning trying to get this to work. What seems to suck is your ALB will return an error with no details.

timrichard 8y ago

Looks interesting. Although the example has a TTL of 7 days for the session cookie, which contains an identifier used by the service provider to uniquely fingerprint an individual user. Under GDPR, does all trace of a user have to be removed immediately on demand, even if this has been effectively delegated to something like the ALB?

edf13 8y ago
Don't think it states anywhere that all trace of a user have to be removed immediately on demand. Generally speaking you have 30 days to remove personal data (But there is a bit more to it than that). A good overview is from the UK ICO: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- bjpbakker 8y ago
  Also, it has to be technically feasible to remove the user data. So I don't think data stored on the client's own device is data that you necessarily should remove (though IANAL).

scwoodal 8y ago

How does one go about getting authentication like this working in a development environment?

nzoschke 8y ago
I do JWT token auth for apps as documented here: https://github.com/nzoschke/gofaas/blob/master/docs/security-cors-jwt.md https://github.com/nzoschke/gofaas/blob/master/docs/security... In dev I run the same exact code and copy the JWT cookie from my production site. Both dev and prod have the same secret to validate the cookie.
- mkarazin 8y ago
  You probably are well aware, but security wise that's a huge issue. If it's a hobby app, okay, but anything with actual users should separate keys. The main concern would be that dev keys are not considered secure and anyone with access to the dev key could then impersonate any other user of the production application.
- scwoodal 8y ago
  I wouldn't want to share keys like that. I'd also lose out on being able to modify my test account(s) with different groups/permissions that might not be in production yet.

nzoschke 8y ago

Does anyone on Heroku want similar functionality — a shared auth layer for many apps? I have an addon that puts CloudFront in front of you Heroku app with one click: https://elements.heroku.com/addons/edge https://elements.heroku.com/addons/edge I have been thinking about adding auth via Lambda@Edge... Now I have a nice implementation to copy...

zie 8y ago
or via HAProxy and hashicorp-vault I found this: https://github.com/csawyerYumaed/hapvault https://github.com/csawyerYumaed/hapvault

theseanstewart 8y ago

There is a missing link in the demo after logging in. 2nd paragraph says... > Click here to see what info was shared with this website after you authenticated.

kennydude 8y ago

I don't get why you'd use this over something like Python Social Auth which is debuggable, runs on any platform and lets you tweak it much much further :G

bmelton 8y ago
I assume it's for the same reason that people use services like Auth0 -- they don't want to waste development time programming all the fringe cases for authentication, when all they really care about is logging a user in and trusting that they are who they say they are. Some benefits: * Quicker to MVP * Don't have to rewrite AuthX for each platform (web, iOS, Android, etc) * Less worrying about the various permutations of 2-factor across all the applicable auth types (username, email, oauth, LDAP) * Not having to figure out how to federate identity * Not wanting the burden of GDPR/Privacy compliance in-app etc.

eganist 8y ago

Does Cognito still not support CAS for SSO? I'm not seeing any references to it via my google-fu. Quite a number of institutions in my vertical have focused on CAS as opposed to other protocols, hence the ask.