4 ms·
I'm not a Googler, but this massively understates the architecture they've built. The beyondcorp "smart reverse proxy" solves authentication, but the true innov
by xyzzy_plugh 5y ago
I'm not a Googler, but this massively understates the architecture they've built. The beyondcorp "smart reverse proxy" solves authentication, but the true innovation is entirely about contextual authorization. Beyondcorp just binds that context to a human's actions for systems to consume.
You can also see this publicly in GCP's Workload Identity and ALTS primitives, which enable very sophisticated policies.
- lokar 5y agoI was there when it was built Almost all the smarts are in the proxy. If you have a typical web based app integration is easy, not some impossible mandate.
- xyzzy_plugh 5y agoSure, I said nothing to the contrary. It's a minor simplification to call it a reverse proxy. The proxy is built upon a very deep investment in infrastructure, take all of the cert signing stuff, for example. Most BeyondCorp concepts seem simple, and they are, but they depend on a lot of existing machinery, almost all of which is non-existent in pre-existing corp networks. The average tech company is currently struggling to catch up.
- lokar 5y agoMy point was that it is simple from the POV of the app developer. See the comment I replied to.
- 0xbadcafebee 5y agoDo you notice all the different components on this page? https://beyondcorp.com/ https://beyondcorp.com/ There are a lot more components and concepts than just an OAuth proxy. A web developer may think it's all very simple from their perspective, but it goes much deeper.
- lokar 5y agoI know on great detail the implementation and what went into it. My point was it is simple for an app developer to integrate with.