This part is really eye-opening on getting an organization to open source their code: https://increment.com/security/open-sourcing-buzzfeeds-single-sign-on-pro

This part is really eye-opening on getting an organization to open source their code: https://increment.com/security/open-sourcing-buzzfeeds-single-sign-on-process/#securing-our-systems https://increment.com/security/open-sourcing-buzzfeeds-singl... There's understandably a lot of pressure in open sourcing anything security related. I wonder if that's because this SSO project belongs to Buzzfeed, and not a company that specializes in API gateways, like Kong: https://github.com/ohioit/kong-oauth-sso https://github.com/ohioit/kong-oauth-sso So many devs end up implementing oauth & sso through an API gateway when they move to microservices (we did). I'm just surprised that those features don't exist in popular gateways like nginx & haproxy in the non-enterprise versions. It seems sorely needed!