5 ms·
It’s just a few fields until it’s not. SSO, SAML, SCIM, OIDC, OAuth, 2FA, passwordless auth, verification tokens, etc etc, And, variations of each for wildly p
by SkyPuncher 5mo ago
It’s just a few fields until it’s not.
SSO, SAML, SCIM, OIDC, OAuth, 2FA, passwordless auth, verification tokens, etc etc, And, variations of each for wildly popular systems you’ll be expected to integrate with but don’t support the exact spec.
For a while at my company, half our support engineers time went to handling random SSO issues that came up in our home built auth system.
- jarym 5mo ago"home built auth system" is bound to have "random SSO issues". You fix them, that's how things mature.
- rubogubo 5mo agoI'm guessing they simply didnt want to spend the time and money doing that
- janderson215 5mo agoPossibly didn’t want to accept the additional risk that comes with rolling your own auth as well.
- SkyPuncher 5mo agoYep, it’s just a drag. It’s not our core product value so any effort we put into it is a drag.
- ButyTh0 5mo agoRather than just use an email solution Google built GMail into a massive email solution despite it not being a core product Sometimes that's just an opportunity
- jdmichal 5mo ago> ... not being a core product Technically true, because Google's core product is ads. Also fundamentally wrong, because Gmail serves as a massive source of ad targeting information, in addition to being a high-engagement canvas to display those ads.
- exi2 5mo agoGoogle has not been scanning gmail mails for ad targeting since 2017. I think after 9 years we can finally let that one go. Ad display I'll still grant you of course.
- vinckr 5mo agoI don't think we can let that one go so easily, since they might not be scanning for ad targeting (pinky promise?) - but they most certainly will slurp everything up for their AI stuff: https://blog.google/products-and-platforms/products/gmail/gmail-is-entering-the-gemini-era/ https://blog.google/products-and-platforms/products/gmail/gm...
- ButyTh0 5mo agoSure, now it is. It was an unproven long shot when they built it.
- tomrod 5mo agoSupabase's auth is MIT licensed and OSS, is it not? https://github.com/supabase/auth/blob/master/LICENSE https://github.com/supabase/auth/blob/master/LICENSE
- ctm92 5mo agoSupabase is OSS but it's a real pain to actually self host it
- theturtletalks 5mo agoCouldn’t you get Claude to go into Supabase’s auth code and make your custom like their’s but adapted to your stack?
- linkregister 5mo ago"Claude, make my custom like their's but adapted to my stack. Make no mistakes"
- ofrzeta 5mo agoThis is not funny because people are doing that for real.
- fakedang 5mo agoExhibit A, mi.
- kahnclusions 5mo agoAnd don’t hallucinate.
- theturtletalks 5mo agoYou’ll have to drive the agent to do it, not a one-shot task. It’ll also require you to understand your codebase.
- impulser_ 5mo agoMajority of apps are B2C apps, they don't need any of this. All you need is Apple and Google Oauth.
- mooreds 5mo agoIt depends on your use case. If you are a B2C app, you are probably more concerned about: - social providers (Apple and Google being the big ones, but others could play a role--FB or Tiktok for example) - easy registration (but not too easy, you want to avoid bot spam) - self-service account management (updating profile fields, consents [CCPA, GDPR, others], resetting passwords - single sign-on between your apps (if you have multiple) - language support (for your backend, and mobile/web front end) - cost - possibly MFA, possibly passkeys
- sandeepkd 5mo agoIf you are just starting out its probably a good idea. Think about the use case when google bans either your app or bans your app user?
- deaux 5mo agoThen your business is entirely screwed anyway because you've just lost half the market At least to me it sounded very much like they were talking about mobile.
- amluto 5mo agoIs this perhaps a reason to have a Users table that is separate from the table of data on how you authenticate that user?
- sreekanth850 5mo agoI don’t know when we became this lazy. Auth is hard, sure, but putting your users table and sessions behind a vendor API is not something cool. Tell me one feature that is not supported by libraries like OpenIddict (You can build around) or Keycloak?
- selfmodruntime 5mo agoWell the disadvantage is that you're responsible for your companies keycloak.
- Gareth321 5mo agoExactly. Do you want to become ops? Because that's how you become an ops team.
- sevenzero 5mo agoI think the main argument usually is time savings. Personally I just always do E-Mail and password auth, yea its old and not the shiny new thing, but it doesn't require me to integrate 200 different ways of doing auth. We should be able to demand users remembering their passwords, I dont like to cater towards users who simply dont want to put in the work to use my product. Will I lose potential users over this? Yes. Does it feel bad knowing I am in control and wont have to offload to 3rd party vendors? Hell no.
- sreekanth850 5mo agoSame here, Just email + password, no google dependency initially. If more users ask we will think of it. but again you don't need a cloud vendor for all this.
- dotancohen 5mo agoThat's great for B2C, but B2B demands SSO.
- sevenzero 5mo ago
- sebmellen 5mo agoJust use Ory Kratos and self host it.
- EtienneK 5mo agoThat’s when you install Keycloak.
- faangguyindia 5mo agois it just me? who just uses magic links delivered via email or telegram as backup?
- vinckr 5mo agoPersonally I hate magic links via email with a passion and will actively avoid products that have this as the only authentication method
- moooo99 5mo ago> For a while at my company, half our support engineers time went to handling random SSO issues that came up in our home built auth system. fwiw, we also have entire staff dealing with SSO issues among our employees and users, despite relying on external services to handle auth. A problem domain as complex as authentication is bound to habe issues of some sort. But I am not sure if I would be so fond of „outsourcing“ something as integral to my services as the access to these services
- Gareth321 5mo agoThere is a trust component for sure, but a business requires assessing the value of time against revenue. I can say for our org that using an off the shelf solution like Clerk saves us time and money and we believe the risk is very small relative to the savings. Maybe the cost for you is not large right now, but when you've got 20 enterprise customers all asking for specific OIDC integrations configured with Private Link, custom domains, and private clusters, an auth solution starts looking mighty fine.