8 ms·
Okta Outage
- sbilstein 5y agorolling your own auth is underrated.
- teddyh 5y agohttps://news.ycombinator.com/item?id=29567170 https://news.ycombinator.com/item?id=29567170
- dingosity 5y agoOh. It wasn't just me.
- whalesalad 5y agoTIL okta is in us-west-2
- pdx6 5y agoOkta uses nearly all the us regions, with older (and larger) customers in us-east-1. I used to work there and know the internals well. These aws outages must be causing massive chaos there.
- gabrielsroka 5y agoWith redundancy in other regions https://www.okta.com/video/oktane19-roadmap-why-building-customer-identity-is-hard/ https://www.okta.com/video/oktane19-roadmap-why-building-cus...
- marcinzm 5y agoGiven they were down I would say there was, in practice, no redundancy. Simply claiming something doesn't make it true.
- gabrielsroka 5y agoI don't know the details but they don't fail over automatically. There has to be a reason to push the button. Perhaps the reason did not exist this time. But I know for sure that there is redundancy.
- anonymousiam 5y agoHeh. Our company just switched to their TFA from MS as of this morning. Poor timing.
- polskibus 5y agoWhat was the business rationale for such switch? I usually see people migrate toward MS auth not away from it.
- nefitty 5y agoI had to use Okta at a company once. I asked myself the very same question you posed, every single day.
- vosper 5y agoIs MS auth better? Does that mean Active Directory? We're in the middle of a migration from in-house auth (which we need to get rid off) to Okta and I think the people involved are finding Okta pretty confusing. But it's a big product and auth stuff is complicated, so I'm not sure how much it's Okta's fault.
- vladvasiliu 5y agoIn the context of Okta it's probably AzureAD. But yes, it's related to Active Directory, you can easily sync the two. It's probably why many companies use it: it's easy to add on to your existing Windows infrastructure. My client uses it, it works mostly well. It does have its annoying limitations, though, such as no group inheritance and limited support for hardware tokens outside of Windows (no support on Safari/iOS, Safari/macOS, Firefox/Linux).
- count 5y agoWhat do you mean hardware tokens outside of windows? For primary workstation authentication? Or AzureAD auth? By hardware tokens do you mean RSA or TOTP hardware fobs?
- tyingq 5y agoI know there are complexities involved, but auth is one of those things that needs to be very insulated from single region issues. How long was Okta not working for customers?
- kache_ 5y agoIf you only knew how bad modern software infrastructure really was
- tyingq 5y agoYeah, for a similar vendor, it's interesting to read this page and look at the diagram: https://auth0.com/availability-trust https://auth0.com/availability-trust And then read this tweet: https://twitter.com/auth0/status/1471159935597793290 https://twitter.com/auth0/status/1471159935597793290 Edit: Ah, seems they picked us-west-1 and us-west-2 as the two regions..."In this case, we use two AWS regions: us-west-2 (our primary) and us-west-1 (our failover)."[1] So bit by a double-region failure. [1] https://auth0.com/blog/auth0-architecture-running-in-multiple-cloud-providers-and-regions/ https://auth0.com/blog/auth0-architecture-running-in-multipl...
- crescentfresh 5y agoNow that Okta bought Auth0 what's the developer experience like I wonder? I imagine the infrastructure of the two products are still completely isolated. But is it still a separate product you can use for identity management or are new customers forced to use Okta?
- nickdothutton 5y agoAuth services need to be engineered for at least five nines if not six. System design fail.
- nonameiguess 5y agoProbably this isn't their only outage of the decade, but if so, 45 minutes out of ten years actually is five nines.
- justapassenger 5y agoYou can engineer for any number of nines and still have massive outages.
- thrashh 5y agoWith that logic, you can do anything and it’s A-OK if nothing you do succeeds.
- salawat 5y agoCan confirm. This is how the world works smh.
- justapassenger 5y agoThat's not the point. 9s and SLAs are contractural obligations, not laws of physics that cannot be broken. I saw many systems engineered for a lot of 9s be down hard for much longer than 9s promised, most often due to perfect storm of issues. 9s are great, and communicate pretty well what system was designed for, but they are in no way hard guarantee that the system will be up.
- nexuist 5y agoI mean...you tried. What are you supposed to do if you fail, quit and never come back? That's terrible logic too.
- stavros 5y agoWhat I like to call "nine fives".
- mooreds 5y agoI think this is why having the ability to self-host is worthwhile. This option gives you flexibility to bring this stuff in house if you want to build a team to operate it (or put it on a current team's todo list). Should you? I don't know your situation and whether you can build an Okta-caliber level team internally. (My guess is that many smaller or non-tech focused orgs would have a hard time with that, but that's just a guess.) It's a hard question worth asking. It's easy to think "we could have done better" when things are on fire, as opposed to all the times when the status chart is all green and you don't have to think about Okta (feel free to s/Okta/other service provider/) at all. Disclosure: I work for FusionAuth, an auth provider that has both SaaS and self-hosted installation options.
- zitterbewegung 5y agoWhen I worked for an event services company and a fairly large SR22 / budget insurance company the better question is not cloud or no but really hybrid cloud systems. The first one had a rather long downtime event that they invested in a remote failsafe. The insurance company was largely resilient and when power went out the servers were up but the people doing work weren't able to come there. They bought a generator but they weren't able to turn it on. Blaming Okta or any other group isn't the issue. Your customers don't care how you are down they only care if you are down. Also, I got a bill from Amazon when I forgot to shut down a pagemaker instance and that cost me $700. I self host now buying a business internet package with a static ip. I also upgraded the machine but it wasn't necessary and in hindsight I shouldn't have done the upgrade but just fix the case.
- pithon 5y agoSo glad that half my company's internal stuff falls apart when some external service goes down... I couldn't even submit tickets to my company's helpdesk about the other networking issues I was having. What a joke.
- dijit 5y agoBut, isn't that what everyone on hackernews keeps advocating for? The notion of self-hosting is that you have to hire expensive operations staff and maybe you have sub-par experience due to lack of investment. There is often an argument about "lack of core competency" too. Facebook famously runs their own infra but that didn't work so well for them. -- FWIW I'm actually of the other notion; I truly believe that you should minimise external dependencies. But that's because I'm a sysadmin (now: SRE) and it's my job to worry about reliability of systems. Less complexity and less external dependency ususally coincide with higher reliability. A person could reasonably argue that it's in my interest to prefer companies run their own stuff, since it might be my job to maintain it, so it's self-serving. So I am not unbiased I suppose.
- elasticventures 5y agookta passport is such garbage. it's an absolute steaming pile of garbage sold to unwitting enterprise clients who can't identify bad technology. why do i say this? At least as of Oct 2021 Okta didn't even have a complete compositional API to setup accounts -- thus requiring a 'josh-api', literally a guy named josh to manually provision new customer accounts by hand. the latency on those api requests was immense. the company i was working at still depended on java 8, never budgeted time for refactor or maintenance, and had a plurality of other horrible dev practices they justified (calling themselves agile, devops, but not actually doing any of those things properly) i was still in my probationary period when told me they were going to roll out Okta to all clients early in 2022 and charge for SSO so they could line their pockets, i gave my notice the next day (for many reasons, including okta). josh also gave notice and left on the same day. given log4js, etc. this has probably been an extremely bad week there.
- CPLX 5y agoI’m actively looking now for an SSO solution, SMB scale. What’s the one that doesn’t suck?
- luckman212 5y agoIs JumpCloud any good? (not a recommendation)
- jsiaajdsdaa 5y ago@PostMapping(value="/createAccount") public String createAccount(String user, String pass){ var hashmap = readUserMapFromDisk(MYUSERS.PATH_TO_TXT_FILE); hashmap.putIfAbsent(user, pass); writeToDisk(hashmap, MYUSERS.PATH_TO_TXT_FILE); return "All done " + LocalDateTime.now(); } EDIT: Just imagine the string args are in a more complex object that can be serialized to JSON
- neurostimulant 5y agoKeycloak[1] is self-hosted and widely used. Kratos[2] is also self-hosted but API only, but on the plus side won't have problem with "josh-api" like GP described above. [1] https://github.com/keycloak/keycloak https://github.com/keycloak/keycloak [2] https://github.com/ory/kratos https://github.com/ory/kratos