5 ms·

The process of open-sourcing BuzzFeed’s single sign-on experience

138 points by joeyespo 8y ago

minimaxir 8y ago
Link to the Show HN of BuzzFeed SSO: https://news.ycombinator.com/item?id=17828293 https://news.ycombinator.com/item?id=17828293
Lx1oG-AWb6h_ZG0 8y ago
Maybe I’m missing something, but what is the advantage of maintaining a separate oauth provider (sso-auth)? Since they apparently need to support just google creds, why not let sso-proxy talk to google directly? Why do they need to maintain a separate token infrastructure? The other (related) question is how the token refresh works - is it tied to the underlying refresh token generated by google, or is it something completely independent?
- X-Istence 8y ago
  sso-auth allows you to authenticate against Google once, and then any other requests that come to it can be redirect back to the calling application without first hitting Google. If you registered each new app directly with Google, every time the user visited a new app, they would be redirect to Google to provide permission to the app to log them in, and then be redirected back. This is described in: https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6 https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6
  - Lx1oG-AWb6h_ZG0 8y ago
    > Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com That’s the part I’m confused about. They force all sites that need SSO to be under the same subdomain. If they can share the same session cookie, why does each microservice need to redirect at all? Can’t they all use the same oauth app underneath?
    - Buge 8y ago
      One possible reason is they might want each microservice to be a separate security domain. So that if one microservice is compromised, attackers cannot use credentials stolen from that microservice to control other microservices.
    - X-Istence 8y ago
      There is no requirement for all of them to be under the same domain. It's not made clear in the article, but the documentation shows how you can run all of them under different domains too.
- luckydata 8y ago
  I think it's well explained in the article.
Walkman 8y ago
Oh man, my heart breaks when I see yet another auth framework _yet again_ on HN front page, because I work for a company selling Identity Access Management solutions, so I'm not allowed to work on my dream authentication framework [1] for obvious legal reasons. I know a lot of problems regarding authentication and SSO, and I have such a simple solution in my head for a lot of use cases which would be useful for a lot of companies. It is especially annoying because I see how companies pay millions of dollars for fucking terrible solutions I don't think it's fair. The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do? [1]: https://github.com/kissgyorgy/fancy-auth https://github.com/kissgyorgy/fancy-auth
- notyourwork 8y ago
  > The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do? Why is this not ethical? A lot of people I know who started their own company usually spun the idea off of experience from their prior employer. If its not ethical why not build it in your current company?
  - Walkman 8y ago
    > Why is this not ethical? Everything I learned about authentication, I learned at this company by digging the code base and understanding our customer's problems. I don't think this is the same like "I worked a lot with XY web framework so I start a startup with XY." I actually learned the domain of authentication only on company time. > If its not ethical why not build it in your current company? That's a good question I'm not allowed to answer here :D
    - barkingcat 8y ago
      If that is not ethical then the entire Western business world will collapse. This is what "work" accomplishes. You go to work, exchange your time for services done for the company. In exchange, the company gives you money, and yes - extreme amounts of domain knowledge, to the extent that you might be the only person on the planet who knows X topic. Then you take it to the next workplace, to spread it and to innovate. If your current company doesn't like it, they can 1) increase the pay - like pay you so much money that you're willing to stay. or 2) sue you and crush you so that even if you go elsewhere lawyers will be on you everywhere you go. This is how every single person alive on the planet does it. Without knowledge transfer and this type of behaviour, we would never progress beyond the industrial age.
shay_ker 8y ago
This part is really eye-opening on getting an organization to open source their code: https://increment.com/security/open-sourcing-buzzfeeds-single-sign-on-process/#securing-our-systems https://increment.com/security/open-sourcing-buzzfeeds-singl... There's understandably a lot of pressure in open sourcing anything security related. I wonder if that's because this SSO project belongs to Buzzfeed, and not a company that specializes in API gateways, like Kong: https://github.com/ohioit/kong-oauth-sso https://github.com/ohioit/kong-oauth-sso So many devs end up implementing oauth & sso through an API gateway when they move to microservices (we did). I'm just surprised that those features don't exist in popular gateways like nginx & haproxy in the non-enterprise versions. It seems sorely needed!
gammateam 8y ago
We use ethereum address namespace for standardized cryptographic key pairs, and standardized signing. Through our API we also let people build hosted solutions that let people make familiar usernames and passwords, for people that would find too much friction getting into the ethereum ecosystem. But its not like you need cryptocurrency to sign. Any wallet will do, We’ll also release our own eventually which will just be a code fork with our own branding And people wont even know about any of that web3 cryptocurrency stuff.
- xfitm3 8y ago
  Spam?
  - gammateam 8y ago
    why would it be spam?
barbecue_sauce 8y ago
Seems strange to me to use OAuth for internal SSO. I'm not sure I would want my Google identity explicitly linked to my corporate identity.
- tphan 8y ago
  The company would create a new Google account for you.
charliebrownau 8y ago
Why the fark would any LOGICAL RATIONAL person want to use, common or read articles from * Buzzfeed * Vice * Verge * Vox * CNN or any of the Global LEFT wing Regressive political lame steam media outlets ?

138 points by joeyespo 8y ago

Link to the Show HN of BuzzFeed SSO: https://news.ycombinator.com/item?id=17828293 https://news.ycombinator.com/item?id=17828293

Lx1oG-AWb6h_ZG0 8y ago

Maybe I’m missing something, but what is the advantage of maintaining a separate oauth provider (sso-auth)? Since they apparently need to support just google creds, why not let sso-proxy talk to google directly? Why do they need to maintain a separate token infrastructure? The other (related) question is how the token refresh works - is it tied to the underlying refresh token generated by google, or is it something completely independent?

X-Istence 8y ago
sso-auth allows you to authenticate against Google once, and then any other requests that come to it can be redirect back to the calling application without first hitting Google. If you registered each new app directly with Google, every time the user visited a new app, they would be redirect to Google to provide permission to the app to log them in, and then be redirected back. This is described in: https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6 https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6
- Lx1oG-AWb6h_ZG0 8y ago
  > Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com That’s the part I’m confused about. They force all sites that need SSO to be under the same subdomain. If they can share the same session cookie, why does each microservice need to redirect at all? Can’t they all use the same oauth app underneath?
  - Buge 8y ago
    One possible reason is they might want each microservice to be a separate security domain. So that if one microservice is compromised, attackers cannot use credentials stolen from that microservice to control other microservices.
  - X-Istence 8y ago
    There is no requirement for all of them to be under the same domain. It's not made clear in the article, but the documentation shows how you can run all of them under different domains too.
luckydata 8y ago
I think it's well explained in the article.

Walkman 8y ago

Oh man, my heart breaks when I see yet another auth framework _yet again_ on HN front page, because I work for a company selling Identity Access Management solutions, so I'm not allowed to work on my dream authentication framework [1] for obvious legal reasons. I know a lot of problems regarding authentication and SSO, and I have such a simple solution in my head for a lot of use cases which would be useful for a lot of companies. It is especially annoying because I see how companies pay millions of dollars for fucking terrible solutions I don't think it's fair. The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do? [1]: https://github.com/kissgyorgy/fancy-auth https://github.com/kissgyorgy/fancy-auth

notyourwork 8y ago
> The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do? Why is this not ethical? A lot of people I know who started their own company usually spun the idea off of experience from their prior employer. If its not ethical why not build it in your current company?
- Walkman 8y ago
  > Why is this not ethical? Everything I learned about authentication, I learned at this company by digging the code base and understanding our customer's problems. I don't think this is the same like "I worked a lot with XY web framework so I start a startup with XY." I actually learned the domain of authentication only on company time. > If its not ethical why not build it in your current company? That's a good question I'm not allowed to answer here :D
  - barkingcat 8y ago
    If that is not ethical then the entire Western business world will collapse. This is what "work" accomplishes. You go to work, exchange your time for services done for the company. In exchange, the company gives you money, and yes - extreme amounts of domain knowledge, to the extent that you might be the only person on the planet who knows X topic. Then you take it to the next workplace, to spread it and to innovate. If your current company doesn't like it, they can 1) increase the pay - like pay you so much money that you're willing to stay. or 2) sue you and crush you so that even if you go elsewhere lawyers will be on you everywhere you go. This is how every single person alive on the planet does it. Without knowledge transfer and this type of behaviour, we would never progress beyond the industrial age.

shay_ker 8y ago

This part is really eye-opening on getting an organization to open source their code: https://increment.com/security/open-sourcing-buzzfeeds-single-sign-on-process/#securing-our-systems https://increment.com/security/open-sourcing-buzzfeeds-singl... There's understandably a lot of pressure in open sourcing anything security related. I wonder if that's because this SSO project belongs to Buzzfeed, and not a company that specializes in API gateways, like Kong: https://github.com/ohioit/kong-oauth-sso https://github.com/ohioit/kong-oauth-sso So many devs end up implementing oauth & sso through an API gateway when they move to microservices (we did). I'm just surprised that those features don't exist in popular gateways like nginx & haproxy in the non-enterprise versions. It seems sorely needed!

gammateam 8y ago

We use ethereum address namespace for standardized cryptographic key pairs, and standardized signing. Through our API we also let people build hosted solutions that let people make familiar usernames and passwords, for people that would find too much friction getting into the ethereum ecosystem. But its not like you need cryptocurrency to sign. Any wallet will do, We’ll also release our own eventually which will just be a code fork with our own branding And people wont even know about any of that web3 cryptocurrency stuff.

xfitm3 8y ago
Spam?
- gammateam 8y ago
  why would it be spam?

barbecue_sauce 8y ago

Seems strange to me to use OAuth for internal SSO. I'm not sure I would want my Google identity explicitly linked to my corporate identity.

tphan 8y ago
The company would create a new Google account for you.

charliebrownau 8y ago

Why the fark would any LOGICAL RATIONAL person want to use, common or read articles from * Buzzfeed * Vice * Verge * Vox * CNN or any of the Global LEFT wing Regressive political lame steam media outlets ?