7 ms·

Supabase Auth: SSO, Mobile, and Server-Side Support

183 points by bennyp101 4y ago

bennyp101 4y ago
I've been waiting for this! Super excited to try it out!
- kiwicopple 4y ago
  any particular feature that you were waiting for in this release? I want to highlight from my comment[0] that PKCE will be rolling out progressively (starting next week). You can reach out to the support team if you want it enabled immediately on any of your projects [0] https://news.ycombinator.com/item?id=35555385 https://news.ycombinator.com/item?id=35555385 [1] support: https://app.supabase.com/support/new https://app.supabase.com/support/new
  - bennyp101 4y ago
    The `SAML 2.0, for developers can add SSO to their own apps` - I was looking at using BoxyHQ for it, but didn't really want another moving part, so this nicely fills in that space!
    - kiwicopple 4y ago
      good luck building and let us know if you get stuck. BoxyHQ is also a fantastic product, and their developers have contributed OAuth providers and patched to Supabase Auth. I highly recommend it if you are looking outside the Supabase ecosystem.
kiwicopple 4y ago
hey hn, supabase ceo here this one is really 3 launches for auth: - SAML 2.0, for developers can add SSO to their own apps - PKCE: support for Mobile and server-side auth - Native Apple login on iOS We’ve been dogfooding SSO already and it stable. PKCE is going to be rolled out incrementally across the platform - we’ve tried to engineer it so that there are no breaking changes for your applications, but will exercise caution with the deployment. A lot of companies were blocked by the lack of iOS support - we had a lot of feedback on this one and so we appreciate the patience while we developed it. Native Android support will follow soon. Some of the Auth team will be in to answer questions on the technical side. This is the second-to-last day of Launch Week - I promise that you’ll be rid of us after a few more releases tomorrow.
- no_wizard 4y ago
  Can’t tell from (admittedly skimming) the announcement: is SSO charged extra? It says availability on Pro plan but pricing page hasn’t changed it only says social auth
  - deleted 4y ago
    [deleted]
  - kiwicopple 4y ago
    The pricing is listed in the "Single Sign-On (SAML 2.0)" row on the pricing page: https://supabase.com/pricing https://supabase.com/pricing It's available on the Pro Tier. You get 50 free users, then $0.015 per additional MAU. We always aim for simple, transparent, and pricing - we're hoping this is a good balance. And just to be clear, this is for building SSO for your own apps, this is not SSO for the supabase platform (which we're still figuring out pricing for, and yes - we're well aware of the SSO Tax).
    - no_wizard 4y ago
      Awesome and Awesome! I'm distinctly looking at it from an application point of view right now, SSO just made Supabase very attractive, as well as the SOC Type 2 certification recently announced (yesterday iirc). These were hurdles for our customers, so I'm checking this out with great interest. Great job team! EDIT: With Regards To The SOC Certification a short announcement might be useful for linking purposes.
      - kiwicopple 4y ago
        yes, we now have SOC2 Type2. It wasn't much of an announcement, just a comment: https://news.ycombinator.com/item?id=35526018 https://news.ycombinator.com/item?id=35526018
- krooj 4y ago
  FWIW, the language on your PKCE flow is wrong: * It's not establishment of a "session", but a token set which you're issuing. * The authorization server will return those tokens after validating the code_verifier. Also, be careful about PKCE on mobile platforms. Unless you're specifically mapping or restricting redirect_uris to an Android intent, on that platform, you're subject to replay attacks due to some cookie sharing in Chrome.
no_wizard 4y ago
I think this question deserves a separate thread: Is it possible to see some working examples with some of the big SSO providers, e.g. integrating with Okta, Duo and AD installations in particular (like Azure AD and standard ActiveDirectory) in the documentation? This would go a long way for smaller app developers to get SSO into their apps, even if the examples aren't exhaustive its a starting point. I have found (having done SSO integrations before) that it can be really opaque sometimes reading their API documentation to add support to for such platforms. I mention AD specifically because its a huge hurdle for the education markets still, for example
- kiwicopple 4y ago
  > I have found (having done SSO integrations before) that it can be really opaque sometimes reading their API documentation to add support to for such platforms. Our auth team agrees. We have some docs which you can use as a starter for Azure[0], Google[1], and Okta[2]. These are for our own platform, we'll repurpose them into guides for you to use. We also have full SAML docs[3], and an example in a PR[4]. You can see the example in action inside the video on the blog post [0] Azure: https://supabase.com/docs/guides/platform/sso/azure https://supabase.com/docs/guides/platform/sso/azure [1] Google: https://supabase.com/docs/guides/platform/sso/gsuite https://supabase.com/docs/guides/platform/sso/gsuite [2] Okta: https://supabase.com/docs/guides/platform/sso/okta https://supabase.com/docs/guides/platform/sso/okta [3] SAML: https://supabase.com/docs/guides/auth/sso/auth-sso-saml https://supabase.com/docs/guides/auth/sso/auth-sso-saml [4] SSO example: https://github.com/supabase/supabase/pull/13678 https://github.com/supabase/supabase/pull/13678
- grinich 4y ago
  If you want to see a demo of how to set up SSO, check out the WorkOS Admin Portal. https://workos.com/admin-portal https://workos.com/admin-portal It's essentially "Stripe Checkout" but for enterprise features like SAML and SCIM. Live demo: https://demo.workos.com/ https://demo.workos.com/ (I work at WorkOS - sorry if this is hijacking this thread!)
lelo_tp 4y ago
Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that. If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The only one that exists uses email/password, and the OAuth flow is more convoluted than that :)
- kiwicopple 4y ago
  thanks for the suggestion. We're working on a full RN example here: https://github.com/supabase-community/create-t3-turbo https://github.com/supabase-community/create-t3-turbo Unfortunately we didn't quite finish it for the launch today, but it will be ready next week and we'll add it to the documentation.
  - tough 4y ago
    Oh I didn't see this post awesome, will keep an eye on the repo
- deleted 4y ago
  [deleted]
andymitchell 4y ago
I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure. This is perhaps a future topic, but to me it extends out of SSO: Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that makes great sense), my wishlist: - It should be as simple as an API end point, .approve(auth.jwt(), Array<Role | Permission>). I.e. be available in Edge Functions, Postgres Functions, and anywhere else. - Use a policy schema with the most industry support for easier acceptance/integration with the enterprise. - Flesh out with enterprise-ready policy auditing tools, logging, etc. This is the real time saving for developers. - I really recommend Tailscale's ideas for better RBAC in https://tailscale.com/blog/rbac-like-it-was-meant-to-be/ https://tailscale.com/blog/rbac-like-it-was-meant-to-be/
- kiwicopple 4y ago
  > do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand why it's useful to have something more structured like RBAC. We have experimented with a ideas here (specifically ABAC), using a custom libraries/extensions/custom claims[0]. We do something similar internally, but aren't 100% happy with the developer experience and don't plan to release it any time soon. I'm sure the Auth team won't enjoy me saying this, but I like the idea of Zanzibar. I've seen some experimental Postgres extensions[1] that combine Oso[2] + RLS which I'd love to try when I get time. [0] custom claims: https://dev.to/supabase/supabase-custom-claims-34l2 https://dev.to/supabase/supabase-custom-claims-34l2 [2] Oso + RLS: https://github.com/MFAshby/rls_oso https://github.com/MFAshby/rls_oso [1] Oso: https://www.osohq.com/ https://www.osohq.com/
  - andymitchell 4y ago
    Thanks Paul, Oso looks great. Re: RLS: Pros - The simplicity+security is hard to beat - Supabase is built around it. I really want the purity of just one platform. Cons (in order) - Our enterprise customers need regular oversight of policy + logs for their compliance (and our ongoing relationship). RLS doesn't expose that afaik. - RLS can't control access to API end points in places like Edge Functions (again, afaik). Same for any 3rd party systems you might have mixed in. - In my experience, RLS has quite a few foot guns in it as schemas migrate and evolve (security gaps open up, or recursion bites you).
oakesm9 4y ago
> Building apps for iOS requires support for native Sign in with Apple This part isn't 100% true. It is only a requirement if you have some other form of social login (such as "Login with Facebook") and your app isn't specifically made for using data from that platform (such as a Facebook page managemenet app) [0]. You don't need Sign in with Apple if you only use your own account system. [0]https://developer.apple.com/app-store/review/guidelines/#sign-in-with-apple https://developer.apple.com/app-store/review/guidelines/#sig...
- kangmingtay 4y ago
  Hi, Supabase Auth Engineer here. Thanks for pointing this out, we'll update our blogpost to reflect this.
paradaux 4y ago
What I'd love to see with this is a way to use supabase auth itself as an idP/SAMP provider. Have your tools (back-office tools and what not) written in native supabase, or have multiple supabase projects with the one shared auth system. Could be better UX for Sysadmins than OpenLDAP and so forth. I'm currently building something similar to just do that on top of supabase for work. Happy to see the developments with Supabase Auth anyway.
- kangmingtay 4y ago
  Hi, Supabase Auth Engineer here. Interesting, just wondering if there's a reason behind choosing to roll your own iDP instead of using one of the big ones out there (Okta, Azure, GSuite) ?
  - andymitchell 4y ago
    I'm not the OP, but I do have a request here too. Disclaimer: I haven't built this yet (primarily because it's too hard today). I want to build self-hostable servers, to give our customers the option of privacy and easier compliance. In that arrangement, there'd be: - Our main / central server, for regular SaaS customers. It also provides public assets ("knowledge bases" in this case, but it could be anything - even just licensing info) that all signed-in users have access to. This would be the iDP. - Many self-hosted clones of our central server, per customer Because the central server has the most up-to-date shareable assets, which might be ahead of any upgrade schedule a self-hosted customer has, they'd want their signed in employees to have transparent access to those latest ones too. I.e. without the extra friction of additional sign-in. tl;dr the ability to offer our customers an easy self-hosted option of our Supabase platform (with limited federated access to central data) is highly desirable, now that even SMEs request better infosec. Doing it all inside a Supabase Docker - rather than mixing in Okta - is what makes it maintainable and easy to share. --- EDIT --- This use-case could be written more simply: - There's a platform/app server (built on Supabase). Customers can optionally self-host it for their business. - There's a data server (also built on Supabase, but not self-hosted), that provides shareable assets, even to self-hosted servers. My goal is that it's _seamless_ for self-hosted users to access the data server. So the data server would need to be an iDP. My preference for Supabase to do this (instead of Okta), is because offering a self-hosting option is currently an intimidating maintenance burden, so fewer moving parts (no Okta) is desirable.
jordanmorgan10 4y ago
I want, want, want to use Supabase - I yearn for a first party SDK for iOS.
- kiwicopple 4y ago
  We now support Swift: https://supabase.com/docs/reference/swift/introduction https://supabase.com/docs/reference/swift/introduction We'll double-down on iOS now that we have shipped native Apple logins.
  - jordanmorgan10 4y ago
    Whaaaaat! I didnt know this, awesome!
zinclozenge 4y ago
So if anybody else got excited about multi-tenant SSO but was wondering how to implement it, the docs page is here https://supabase.com/docs/guides/auth/sso/auth-sso-saml https://supabase.com/docs/guides/auth/sso/auth-sso-saml. I'm super excited because as a newcomer to needing to implement that feature, other SaaSes like auth0 were complicated and overwhelmed me. Since we have Supabase employees here, one thing that isn't clear to me is if OIDC based SSO is supported, or will be?
- kangmingtay 4y ago
  Supabase Auth Engineer here. We initially started off with the SAML 2.0 protocol since it's the one of the oldest protocols and also one that's used by most enterprises. We're definitely looking to add OIDC based SSO support soon so stay tuned!
  - zinclozenge 4y ago
    That's awesome, looking forward to it!
asdev 4y ago
who actually uses supabase at scale in production?
- kiwicopple 4y ago
  Specifically for Auth we have linked to a case study at the bottom of this blog post, Parqet, who migrated 125,000 users to Supabase Auth: https://kevcodez.medium.com/migrating-125-000-users-from-auth0-to-supabase-81c0568de307 https://kevcodez.medium.com/migrating-125-000-users-from-aut...
  - asdev 4y ago
    this says nothing about scale. I mean a company who is large(1M +users). This details the complexities of the migration but does not really paint a strong case for using Supabase.
xcskier56 4y ago
Been doing a lot of Auth related stuff the last day or two so in classic HN style this is very timely for me! One of the things that I really dislike about most auth providers is that it is very hard to implement login in your native UI. It almost always requires a redirect to a hosted UI page that is very clearly not your UI. We've found this a poor and potentially confusing user experience when you just need a form with username + password. Question for Supabase: Is it possible to just have a form with username + password and POSTing the login details?
- niklasd 4y ago
  Would that not be a huge security risk? You could access the SSO credentials of your users that way.
- BuySomeDip 4y ago
  Supabase Auth engineer here. > Question for Supabase: Is it possible to just have a form with username + password and POSTing the login details? Yes this is how basic email+password sign-in works. No redirects are necessary. For the rest of the flows, some form of redirect is mandatory because that's how the authentication protocols work and we've found it convenient to implement other logins like magic links, email confirmations, etc.
- kangmingtay 4y ago
  If you're using Flutter, we do have a chat app example that has a basic email + password login. (https://github.com/supabase-community/flutter-chat https://github.com/supabase-community/flutter-chat)
vrglvrglvrgl 4y ago
[dead]
infocollector 4y ago
This project is very impressive! I do hope Supabase decides to support https://github.com/supabase-community/supabase-py https://github.com/supabase-community/supabase-py , and not just leave it to the community. I would definitely consider becoming a paid customer, assuming Python was supported well/natively. If I am incorrect about Python support, please do let me know.
- aceofspade 4y ago
  Supabase Auth Engineer here, also happen to be one of the Python library maintainers. We're looking into a more general approach for "server-side" languages such as Python, Ruby, etc but at the moment the python library is still community supported. Do you mind sharing more about what you're building and the features of Supabase which would be most important to you?
darksaints 4y ago
I’m not currently using supabase but I am using postgrest in a current SSO project, and I ran into major roadblocks with the JWT support. It works fine for versions with symmetric encryption for signing the tokens, where you provide the key to postgrest via config and it uses the key to authenticate requests. However, our identity provider (Azure AD) uses asymmetric encryption for signing tokens, with a public endpoint to retrieve public keys, and postgrest’s support for this is pretty bad. I’ve only been able to work around this issue by serializing the response to a string and providing it as a (really long) config value, and because keys can change over time, I have to restart Postgrest on a daily basis. For more info, see this issue: https://github.com/PostgREST/postgrest/issues/1130 https://github.com/PostgREST/postgrest/issues/1130 Does supabase work around this limitation somehow? How do you get SSO to work for auth providers like Auth0 and AAD that only provide public keys via an endpoint?
- BuySomeDip 4y ago
  Supabase Auth engineer here. PostgREST only has "static" asymmetric JWT support. It can't load from `/.well-known/openid-configuration` endpoints. We are tracking this internally to add better UI and support for third-party OIDC. Most of the OIDC identity providers don't rotate the keys very often, so you can follow the `/.well-known/openid-configuration` endpoint to get the JWKS JSON, and set that as the JWT Secret in the project's dashboard. (It's a bit hacky I know, we're going to be improving the UI on this.) I know this has been used with Firebase Auth, which is also OIDC compatible with asymmetric JWTs. EDIT: > How do you get SSO to work for auth providers like Auth0 and AAD that only provide public keys via an endpoint? Actually what you're describing is technically not "SSO" but using another Auth system with the rest of the Supabase stack. OIDC support for SSO -- where you use Supabase Auth with Azure AD for example -- is on the roadmap, but only SAML is supported with this announcement today.
mkl95 4y ago
Supabase are killing it. I wish they had a Terraform provider.
- jacurtis 4y ago
  Everyone should go upvote the discussion here to let them know how much interest there is for this: https://github.com/orgs/supabase/discussions/5166 https://github.com/orgs/supabase/discussions/5166
- kangmingtay 4y ago
  Actually, we are experimenting with a Terraform provider to manage a project configuration, starting with Auth. What are some other things you'd like to see in the Terraform provider? [1]: supabase-terraform (https://github.com/supabase-community/supabase-terraform https://github.com/supabase-community/supabase-terraform)
niklasd 4y ago
Great news! Question to the Supabase team: How does Login with Azure (Social login) and SSO (Azure) differ? From my superficial understanding, implementing Login with Azure is enough for logging-in users with Azure AD accounts (and linking their accounts to existing ones).
mooreds 4y ago
Disclosure, I work for FusionAuth, which can both integrate with and compete with Supabase. Welcome, Supabase, to the world of SAML/SSO. It's a hairy one, but single sign-on is undifferentiated and really great for customers, so I'm glad you joined. A few thoughts: * Consider adding identity linking to your roadmap. I noticed[0] that you don't support it, and will create duplicate accounts if someone uses SSO with the same email address that an existing account has. As a model, FusionAuth offers seven linking strategies[1]. This flexibility lets you handle more use cases. * I'd encourage you (and your customers) to test across as many SPs as you can. SAML is an 800+ page specification and even though we've been offering SAML for over 10 years and have open sourced our bindings[2], we still have edge cases that pop up. * I'd love to add FusionAuth as a SAML SSO provider to your docs, so will put that on our team's doc roadmap and submit a PR. :) * Not related to SAML, but I'm glad that you are supporting PKCE. I hope you deprecate the implicit grant; the XSS threat is very real and the OAuth 2.1 spec (still in progress) basically deprecates that grant[3] through omission. Also, we agree that setting cookies (HTTPOnly and secure, please) is a great way to store tokens[4] and that is worth requiring a server side component in applications. Finally, I understand why this is part of a paid offering; SAML is often used to segment out enterprise customers with $$$. You like to make money, as do we all. But I'd encourage you to think about a free tier because it is so helpful to the user experience. Maybe 1 SAML connection could be part of the base offering? 0: https://supabase.com/docs/guides/platform/sso https://supabase.com/docs/guides/platform/sso 1: https://fusionauth.io/docs/v1/tech/identity-providers/#linking-strategies https://fusionauth.io/docs/v1/tech/identity-providers/#linki... 2: https://github.com/FusionAuth/fusionauth-samlv2/commits/master?after=337e5cc5ad09676009a8f23c1e9788f558b48693+104&branch=master&qualified_name=refs%2Fheads%2Fmaster https://github.com/FusionAuth/fusionauth-samlv2/commits/mast... 3: https://oauth.net/2.1/ https://oauth.net/2.1/ 4: https://fusionauth.io/learn/expert-advice/oauth/oauth-token-storage https://fusionauth.io/learn/expert-advice/oauth/oauth-token-...
raphaelcosta 4y ago
It works with Supabase self-hosted?
- kiwicopple 4y ago
  yes, it works with self-hosted too - although we just released it this week so it might take another week or so to land in the docker image

183 points by bennyp101 4y ago

bennyp101 4y ago

I've been waiting for this! Super excited to try it out!

kiwicopple 4y ago
any particular feature that you were waiting for in this release? I want to highlight from my comment[0] that PKCE will be rolling out progressively (starting next week). You can reach out to the support team if you want it enabled immediately on any of your projects [0] https://news.ycombinator.com/item?id=35555385 https://news.ycombinator.com/item?id=35555385 [1] support: https://app.supabase.com/support/new https://app.supabase.com/support/new
- bennyp101 4y ago
  The `SAML 2.0, for developers can add SSO to their own apps` - I was looking at using BoxyHQ for it, but didn't really want another moving part, so this nicely fills in that space!
  - kiwicopple 4y ago
    good luck building and let us know if you get stuck. BoxyHQ is also a fantastic product, and their developers have contributed OAuth providers and patched to Supabase Auth. I highly recommend it if you are looking outside the Supabase ecosystem.

kiwicopple 4y ago

hey hn, supabase ceo here this one is really 3 launches for auth: - SAML 2.0, for developers can add SSO to their own apps - PKCE: support for Mobile and server-side auth - Native Apple login on iOS We’ve been dogfooding SSO already and it stable. PKCE is going to be rolled out incrementally across the platform - we’ve tried to engineer it so that there are no breaking changes for your applications, but will exercise caution with the deployment. A lot of companies were blocked by the lack of iOS support - we had a lot of feedback on this one and so we appreciate the patience while we developed it. Native Android support will follow soon. Some of the Auth team will be in to answer questions on the technical side. This is the second-to-last day of Launch Week - I promise that you’ll be rid of us after a few more releases tomorrow.

no_wizard 4y ago
Can’t tell from (admittedly skimming) the announcement: is SSO charged extra? It says availability on Pro plan but pricing page hasn’t changed it only says social auth
- deleted 4y ago
  [deleted]
- kiwicopple 4y ago
  The pricing is listed in the "Single Sign-On (SAML 2.0)" row on the pricing page: https://supabase.com/pricing https://supabase.com/pricing It's available on the Pro Tier. You get 50 free users, then $0.015 per additional MAU. We always aim for simple, transparent, and pricing - we're hoping this is a good balance. And just to be clear, this is for building SSO for your own apps, this is not SSO for the supabase platform (which we're still figuring out pricing for, and yes - we're well aware of the SSO Tax).
  - no_wizard 4y ago
    Awesome and Awesome! I'm distinctly looking at it from an application point of view right now, SSO just made Supabase very attractive, as well as the SOC Type 2 certification recently announced (yesterday iirc). These were hurdles for our customers, so I'm checking this out with great interest. Great job team! EDIT: With Regards To The SOC Certification a short announcement might be useful for linking purposes.
    - kiwicopple 4y ago
      yes, we now have SOC2 Type2. It wasn't much of an announcement, just a comment: https://news.ycombinator.com/item?id=35526018 https://news.ycombinator.com/item?id=35526018
krooj 4y ago
FWIW, the language on your PKCE flow is wrong: * It's not establishment of a "session", but a token set which you're issuing. * The authorization server will return those tokens after validating the code_verifier. Also, be careful about PKCE on mobile platforms. Unless you're specifically mapping or restricting redirect_uris to an Android intent, on that platform, you're subject to replay attacks due to some cookie sharing in Chrome.

no_wizard 4y ago

I think this question deserves a separate thread: Is it possible to see some working examples with some of the big SSO providers, e.g. integrating with Okta, Duo and AD installations in particular (like Azure AD and standard ActiveDirectory) in the documentation? This would go a long way for smaller app developers to get SSO into their apps, even if the examples aren't exhaustive its a starting point. I have found (having done SSO integrations before) that it can be really opaque sometimes reading their API documentation to add support to for such platforms. I mention AD specifically because its a huge hurdle for the education markets still, for example

kiwicopple 4y ago
> I have found (having done SSO integrations before) that it can be really opaque sometimes reading their API documentation to add support to for such platforms. Our auth team agrees. We have some docs which you can use as a starter for Azure[0], Google[1], and Okta[2]. These are for our own platform, we'll repurpose them into guides for you to use. We also have full SAML docs[3], and an example in a PR[4]. You can see the example in action inside the video on the blog post [0] Azure: https://supabase.com/docs/guides/platform/sso/azure https://supabase.com/docs/guides/platform/sso/azure [1] Google: https://supabase.com/docs/guides/platform/sso/gsuite https://supabase.com/docs/guides/platform/sso/gsuite [2] Okta: https://supabase.com/docs/guides/platform/sso/okta https://supabase.com/docs/guides/platform/sso/okta [3] SAML: https://supabase.com/docs/guides/auth/sso/auth-sso-saml https://supabase.com/docs/guides/auth/sso/auth-sso-saml [4] SSO example: https://github.com/supabase/supabase/pull/13678 https://github.com/supabase/supabase/pull/13678
grinich 4y ago
If you want to see a demo of how to set up SSO, check out the WorkOS Admin Portal. https://workos.com/admin-portal https://workos.com/admin-portal It's essentially "Stripe Checkout" but for enterprise features like SAML and SCIM. Live demo: https://demo.workos.com/ https://demo.workos.com/ (I work at WorkOS - sorry if this is hijacking this thread!)

lelo_tp 4y ago

Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that. If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The only one that exists uses email/password, and the OAuth flow is more convoluted than that :)

kiwicopple 4y ago
thanks for the suggestion. We're working on a full RN example here: https://github.com/supabase-community/create-t3-turbo https://github.com/supabase-community/create-t3-turbo Unfortunately we didn't quite finish it for the launch today, but it will be ready next week and we'll add it to the documentation.
- tough 4y ago
  Oh I didn't see this post awesome, will keep an eye on the repo
deleted 4y ago
[deleted]

andymitchell 4y ago

I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure. This is perhaps a future topic, but to me it extends out of SSO: Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that makes great sense), my wishlist: - It should be as simple as an API end point, .approve(auth.jwt(), Array<Role | Permission>). I.e. be available in Edge Functions, Postgres Functions, and anywhere else. - Use a policy schema with the most industry support for easier acceptance/integration with the enterprise. - Flesh out with enterprise-ready policy auditing tools, logging, etc. This is the real time saving for developers. - I really recommend Tailscale's ideas for better RBAC in https://tailscale.com/blog/rbac-like-it-was-meant-to-be/ https://tailscale.com/blog/rbac-like-it-was-meant-to-be/

kiwicopple 4y ago
> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand why it's useful to have something more structured like RBAC. We have experimented with a ideas here (specifically ABAC), using a custom libraries/extensions/custom claims[0]. We do something similar internally, but aren't 100% happy with the developer experience and don't plan to release it any time soon. I'm sure the Auth team won't enjoy me saying this, but I like the idea of Zanzibar. I've seen some experimental Postgres extensions[1] that combine Oso[2] + RLS which I'd love to try when I get time. [0] custom claims: https://dev.to/supabase/supabase-custom-claims-34l2 https://dev.to/supabase/supabase-custom-claims-34l2 [2] Oso + RLS: https://github.com/MFAshby/rls_oso https://github.com/MFAshby/rls_oso [1] Oso: https://www.osohq.com/ https://www.osohq.com/
- andymitchell 4y ago
  Thanks Paul, Oso looks great. Re: RLS: Pros - The simplicity+security is hard to beat - Supabase is built around it. I really want the purity of just one platform. Cons (in order) - Our enterprise customers need regular oversight of policy + logs for their compliance (and our ongoing relationship). RLS doesn't expose that afaik. - RLS can't control access to API end points in places like Edge Functions (again, afaik). Same for any 3rd party systems you might have mixed in. - In my experience, RLS has quite a few foot guns in it as schemas migrate and evolve (security gaps open up, or recursion bites you).

oakesm9 4y ago

> Building apps for iOS requires support for native Sign in with Apple This part isn't 100% true. It is only a requirement if you have some other form of social login (such as "Login with Facebook") and your app isn't specifically made for using data from that platform (such as a Facebook page managemenet app) [0]. You don't need Sign in with Apple if you only use your own account system. [0]https://developer.apple.com/app-store/review/guidelines/#sign-in-with-apple https://developer.apple.com/app-store/review/guidelines/#sig...

kangmingtay 4y ago
Hi, Supabase Auth Engineer here. Thanks for pointing this out, we'll update our blogpost to reflect this.

paradaux 4y ago

What I'd love to see with this is a way to use supabase auth itself as an idP/SAMP provider. Have your tools (back-office tools and what not) written in native supabase, or have multiple supabase projects with the one shared auth system. Could be better UX for Sysadmins than OpenLDAP and so forth. I'm currently building something similar to just do that on top of supabase for work. Happy to see the developments with Supabase Auth anyway.

kangmingtay 4y ago
Hi, Supabase Auth Engineer here. Interesting, just wondering if there's a reason behind choosing to roll your own iDP instead of using one of the big ones out there (Okta, Azure, GSuite) ?
- andymitchell 4y ago
  I'm not the OP, but I do have a request here too. Disclaimer: I haven't built this yet (primarily because it's too hard today). I want to build self-hostable servers, to give our customers the option of privacy and easier compliance. In that arrangement, there'd be: - Our main / central server, for regular SaaS customers. It also provides public assets ("knowledge bases" in this case, but it could be anything - even just licensing info) that all signed-in users have access to. This would be the iDP. - Many self-hosted clones of our central server, per customer Because the central server has the most up-to-date shareable assets, which might be ahead of any upgrade schedule a self-hosted customer has, they'd want their signed in employees to have transparent access to those latest ones too. I.e. without the extra friction of additional sign-in. tl;dr the ability to offer our customers an easy self-hosted option of our Supabase platform (with limited federated access to central data) is highly desirable, now that even SMEs request better infosec. Doing it all inside a Supabase Docker - rather than mixing in Okta - is what makes it maintainable and easy to share. --- EDIT --- This use-case could be written more simply: - There's a platform/app server (built on Supabase). Customers can optionally self-host it for their business. - There's a data server (also built on Supabase, but not self-hosted), that provides shareable assets, even to self-hosted servers. My goal is that it's _seamless_ for self-hosted users to access the data server. So the data server would need to be an iDP. My preference for Supabase to do this (instead of Okta), is because offering a self-hosting option is currently an intimidating maintenance burden, so fewer moving parts (no Okta) is desirable.

jordanmorgan10 4y ago

I want, want, want to use Supabase - I yearn for a first party SDK for iOS.

kiwicopple 4y ago
We now support Swift: https://supabase.com/docs/reference/swift/introduction https://supabase.com/docs/reference/swift/introduction We'll double-down on iOS now that we have shipped native Apple logins.
- jordanmorgan10 4y ago
  Whaaaaat! I didnt know this, awesome!

zinclozenge 4y ago

So if anybody else got excited about multi-tenant SSO but was wondering how to implement it, the docs page is here https://supabase.com/docs/guides/auth/sso/auth-sso-saml https://supabase.com/docs/guides/auth/sso/auth-sso-saml. I'm super excited because as a newcomer to needing to implement that feature, other SaaSes like auth0 were complicated and overwhelmed me. Since we have Supabase employees here, one thing that isn't clear to me is if OIDC based SSO is supported, or will be?

kangmingtay 4y ago
Supabase Auth Engineer here. We initially started off with the SAML 2.0 protocol since it's the one of the oldest protocols and also one that's used by most enterprises. We're definitely looking to add OIDC based SSO support soon so stay tuned!
- zinclozenge 4y ago
  That's awesome, looking forward to it!

asdev 4y ago

who actually uses supabase at scale in production?

kiwicopple 4y ago
Specifically for Auth we have linked to a case study at the bottom of this blog post, Parqet, who migrated 125,000 users to Supabase Auth: https://kevcodez.medium.com/migrating-125-000-users-from-auth0-to-supabase-81c0568de307 https://kevcodez.medium.com/migrating-125-000-users-from-aut...
- asdev 4y ago
  this says nothing about scale. I mean a company who is large(1M +users). This details the complexities of the migration but does not really paint a strong case for using Supabase.

xcskier56 4y ago

Been doing a lot of Auth related stuff the last day or two so in classic HN style this is very timely for me! One of the things that I really dislike about most auth providers is that it is very hard to implement login in your native UI. It almost always requires a redirect to a hosted UI page that is very clearly not your UI. We've found this a poor and potentially confusing user experience when you just need a form with username + password. Question for Supabase: Is it possible to just have a form with username + password and POSTing the login details?

niklasd 4y ago
Would that not be a huge security risk? You could access the SSO credentials of your users that way.
BuySomeDip 4y ago
Supabase Auth engineer here. > Question for Supabase: Is it possible to just have a form with username + password and POSTing the login details? Yes this is how basic email+password sign-in works. No redirects are necessary. For the rest of the flows, some form of redirect is mandatory because that's how the authentication protocols work and we've found it convenient to implement other logins like magic links, email confirmations, etc.
kangmingtay 4y ago
If you're using Flutter, we do have a chat app example that has a basic email + password login. (https://github.com/supabase-community/flutter-chat https://github.com/supabase-community/flutter-chat)

vrglvrglvrgl 4y ago

[dead]

infocollector 4y ago

This project is very impressive! I do hope Supabase decides to support https://github.com/supabase-community/supabase-py https://github.com/supabase-community/supabase-py , and not just leave it to the community. I would definitely consider becoming a paid customer, assuming Python was supported well/natively. If I am incorrect about Python support, please do let me know.

aceofspade 4y ago
Supabase Auth Engineer here, also happen to be one of the Python library maintainers. We're looking into a more general approach for "server-side" languages such as Python, Ruby, etc but at the moment the python library is still community supported. Do you mind sharing more about what you're building and the features of Supabase which would be most important to you?

darksaints 4y ago

I’m not currently using supabase but I am using postgrest in a current SSO project, and I ran into major roadblocks with the JWT support. It works fine for versions with symmetric encryption for signing the tokens, where you provide the key to postgrest via config and it uses the key to authenticate requests. However, our identity provider (Azure AD) uses asymmetric encryption for signing tokens, with a public endpoint to retrieve public keys, and postgrest’s support for this is pretty bad. I’ve only been able to work around this issue by serializing the response to a string and providing it as a (really long) config value, and because keys can change over time, I have to restart Postgrest on a daily basis. For more info, see this issue: https://github.com/PostgREST/postgrest/issues/1130 https://github.com/PostgREST/postgrest/issues/1130 Does supabase work around this limitation somehow? How do you get SSO to work for auth providers like Auth0 and AAD that only provide public keys via an endpoint?

BuySomeDip 4y ago
Supabase Auth engineer here. PostgREST only has "static" asymmetric JWT support. It can't load from `/.well-known/openid-configuration` endpoints. We are tracking this internally to add better UI and support for third-party OIDC. Most of the OIDC identity providers don't rotate the keys very often, so you can follow the `/.well-known/openid-configuration` endpoint to get the JWKS JSON, and set that as the JWT Secret in the project's dashboard. (It's a bit hacky I know, we're going to be improving the UI on this.) I know this has been used with Firebase Auth, which is also OIDC compatible with asymmetric JWTs. EDIT: > How do you get SSO to work for auth providers like Auth0 and AAD that only provide public keys via an endpoint? Actually what you're describing is technically not "SSO" but using another Auth system with the rest of the Supabase stack. OIDC support for SSO -- where you use Supabase Auth with Azure AD for example -- is on the roadmap, but only SAML is supported with this announcement today.

mkl95 4y ago

Supabase are killing it. I wish they had a Terraform provider.

jacurtis 4y ago
Everyone should go upvote the discussion here to let them know how much interest there is for this: https://github.com/orgs/supabase/discussions/5166 https://github.com/orgs/supabase/discussions/5166
kangmingtay 4y ago
Actually, we are experimenting with a Terraform provider to manage a project configuration, starting with Auth. What are some other things you'd like to see in the Terraform provider? [1]: supabase-terraform (https://github.com/supabase-community/supabase-terraform https://github.com/supabase-community/supabase-terraform)

niklasd 4y ago

Great news! Question to the Supabase team: How does Login with Azure (Social login) and SSO (Azure) differ? From my superficial understanding, implementing Login with Azure is enough for logging-in users with Azure AD accounts (and linking their accounts to existing ones).

mooreds 4y ago

Disclosure, I work for FusionAuth, which can both integrate with and compete with Supabase. Welcome, Supabase, to the world of SAML/SSO. It's a hairy one, but single sign-on is undifferentiated and really great for customers, so I'm glad you joined. A few thoughts: * Consider adding identity linking to your roadmap. I noticed[0] that you don't support it, and will create duplicate accounts if someone uses SSO with the same email address that an existing account has. As a model, FusionAuth offers seven linking strategies[1]. This flexibility lets you handle more use cases. * I'd encourage you (and your customers) to test across as many SPs as you can. SAML is an 800+ page specification and even though we've been offering SAML for over 10 years and have open sourced our bindings[2], we still have edge cases that pop up. * I'd love to add FusionAuth as a SAML SSO provider to your docs, so will put that on our team's doc roadmap and submit a PR. :) * Not related to SAML, but I'm glad that you are supporting PKCE. I hope you deprecate the implicit grant; the XSS threat is very real and the OAuth 2.1 spec (still in progress) basically deprecates that grant[3] through omission. Also, we agree that setting cookies (HTTPOnly and secure, please) is a great way to store tokens[4] and that is worth requiring a server side component in applications. Finally, I understand why this is part of a paid offering; SAML is often used to segment out enterprise customers with $$$. You like to make money, as do we all. But I'd encourage you to think about a free tier because it is so helpful to the user experience. Maybe 1 SAML connection could be part of the base offering? 0: https://supabase.com/docs/guides/platform/sso https://supabase.com/docs/guides/platform/sso 1: https://fusionauth.io/docs/v1/tech/identity-providers/#linking-strategies https://fusionauth.io/docs/v1/tech/identity-providers/#linki... 2: https://github.com/FusionAuth/fusionauth-samlv2/commits/master?after=337e5cc5ad09676009a8f23c1e9788f558b48693+104&branch=master&qualified_name=refs%2Fheads%2Fmaster https://github.com/FusionAuth/fusionauth-samlv2/commits/mast... 3: https://oauth.net/2.1/ https://oauth.net/2.1/ 4: https://fusionauth.io/learn/expert-advice/oauth/oauth-token-storage https://fusionauth.io/learn/expert-advice/oauth/oauth-token-...

raphaelcosta 4y ago

It works with Supabase self-hosted?

kiwicopple 4y ago
yes, it works with self-hosted too - although we just released it this week so it might take another week or so to land in the docker image