3 ms·

Lots of good points but ‘outsource’ here can mean a variety of things. We have SuperTokens (self-hosted or SaaS I think) and Keycloak (self-hosted only if I’m

by jarym 6y ago

Lots of good points but ‘outsource’ here can mean a variety of things. We have SuperTokens (self-hosted or SaaS I think) and Keycloak (self-hosted only if I’m not mistaken) so most people don’t need to ‘roll their own’. But would I outsource the essential gateway to my service? Unlikely for the moment.

mooreds 6y ago
Agree that "outsource" can mean different things. If I'm building a rails app, I should "outsource" authentication to Devise or Omniauth (typically). There are lots of great options, libraries and services, commercial and open source, self hosted and operating as a SaaS. What I always want to avoid is anyone running "create table user ( id int(32) ... )". > But would I outsource the essential gateway to my service? Unlikely for the moment. Do you outsource the operation of your database? Some people would never do that, as they consider it core to their business operations and have the skills to run it. Others evaluate the options and decide that outsourcing running a database makes sense for their situation. Engineering is all about tradeoffs.
- marcosdumay 6y ago
  > What I always want to avoid is anyone running "create table user ( id int(32) ... )". Hum... I have never seen a system that could ditch a user table, whatever authn and authz schema it's using. (An independent authn service only makes it more complicated, because you now have redundant user tables.) But a password column can be avoided.
  - mooreds 6y ago
    Fair point, as most systems need to refer to users for internal relations, though with a fully outsourced solution you can get by referencing the external user ids. As you suggest, I should have mentioned the big things to avoid are password hash and salt columns.
    - erwincoumans 6y ago
      So storing password hashes is better done in a file than in a database?
      - marcosdumay 6y ago
        It's better done by some code that you (or anybody not focused on authn) didn't hack-up on half a day. Knowing that the hashes are not stored on the database that most of your external interfaces access can bring a lot of tranquility, but you'll get some PII there anyway, so I'm not sure that tranquility is warranted.
earleybird 6y ago
A data point for hosted Keycloak offering: https://www.cloud-iam.com/ https://www.cloud-iam.com/ No connection to and no opinion of the offering - just noting its existence.

by jarym 6y ago

mooreds 6y ago

Agree that "outsource" can mean different things. If I'm building a rails app, I should "outsource" authentication to Devise or Omniauth (typically). There are lots of great options, libraries and services, commercial and open source, self hosted and operating as a SaaS. What I always want to avoid is anyone running "create table user ( id int(32) ... )". > But would I outsource the essential gateway to my service? Unlikely for the moment. Do you outsource the operation of your database? Some people would never do that, as they consider it core to their business operations and have the skills to run it. Others evaluate the options and decide that outsourcing running a database makes sense for their situation. Engineering is all about tradeoffs.

marcosdumay 6y ago
> What I always want to avoid is anyone running "create table user ( id int(32) ... )". Hum... I have never seen a system that could ditch a user table, whatever authn and authz schema it's using. (An independent authn service only makes it more complicated, because you now have redundant user tables.) But a password column can be avoided.
- mooreds 6y ago
  Fair point, as most systems need to refer to users for internal relations, though with a fully outsourced solution you can get by referencing the external user ids. As you suggest, I should have mentioned the big things to avoid are password hash and salt columns.
  - erwincoumans 6y ago
    So storing password hashes is better done in a file than in a database?
    - marcosdumay 6y ago
      It's better done by some code that you (or anybody not focused on authn) didn't hack-up on half a day. Knowing that the hashes are not stored on the database that most of your external interfaces access can bring a lot of tranquility, but you'll get some PII there anyway, so I'm not sure that tranquility is warranted.

earleybird 6y ago

A data point for hosted Keycloak offering: https://www.cloud-iam.com/ https://www.cloud-iam.com/ No connection to and no opinion of the offering - just noting its existence.