4 ms·
The vast majority of apps at Google that are available "beyond corp" are just normal web apps behind a smart reverse proxy that takes care of everything for the
by lokar 5y ago
The vast majority of apps at Google that are available "beyond corp" are just normal web apps behind a smart reverse proxy that takes care of everything for them.
- xyzzy_plugh 5y agoI'm not a Googler, but this massively understates the architecture they've built. The beyondcorp "smart reverse proxy" solves authentication, but the true innovation is entirely about contextual authorization. Beyondcorp just binds that context to a human's actions for systems to consume. You can also see this publicly in GCP's Workload Identity and ALTS primitives, which enable very sophisticated policies.
- lokar 5y agoI was there when it was built Almost all the smarts are in the proxy. If you have a typical web based app integration is easy, not some impossible mandate.
- xyzzy_plugh 5y agoSure, I said nothing to the contrary. It's a minor simplification to call it a reverse proxy. The proxy is built upon a very deep investment in infrastructure, take all of the cert signing stuff, for example. Most BeyondCorp concepts seem simple, and they are, but they depend on a lot of existing machinery, almost all of which is non-existent in pre-existing corp networks. The average tech company is currently struggling to catch up.
- lokar 5y agoMy point was that it is simple from the POV of the app developer. See the comment I replied to.
- 0xbadcafebee 5y agoDo you notice all the different components on this page? https://beyondcorp.com/ https://beyondcorp.com/ There are a lot more components and concepts than just an OAuth proxy. A web developer may think it's all very simple from their perspective, but it goes much deeper.
- lokar 5y agoI know on great detail the implementation and what went into it. My point was it is simple for an app developer to integrate with.