Viewing profile — cainlevy

Seems like an oversight, doesn't it? I've created an issue to track here: https://github.com/keratin/authn-server/issues/15

Yeah. I think Travis provides a warmed server.

Thanks for the report! I believe I've tracked this down to an initialization routine that MySQL goes through on the first boot. It happens after docker-compose unblocks. Likely a w…

My intention for the user-facing endpoints is that the host app will never need to see or accidentally log a user's password. It's a pattern inspired by credit card vaults. Could y…

Fixed, thanks!

That all sounds like a direction I'd happily consider: * Google Cloud Storage implementations for data interfaces * Metrics interface with a Prometheus implementation (STATSD to fo…

Thanks! Have you seen the /stats endpoint? It exposes the metrics as JSON, which may be a good match for your suggestion. I'd also like to export the key events to a STATSD-compati…

Yep, it's very broad. Let's say it depends how "majestic" a person's monolith is? :D One point of context I'd like to inject here is that chatter between AuthN and a host app is pr…

It's on my roadmap. Prioritizing is hard. :/

Keycloak does some really great things. It does require managing a Java runtime though, and is missing the streamlining that allows AuthN to run as an invisible API. Keycloak (and …

Yeah, I don't expect this JWT scheme to become an adopted standard. It's been streamlined from OIC for the narrow use case of working tightly with a trusted app. Adding support for…

Yeah, name/pass sounds pretty simple, doesn't it? But doing it correctly, securely, with a service architecture? That gets interesting. > It would be much more interesting to me if…

Tests are colocated inside packages (folders) using a `_test.go` convention. Service tests[1] are the main unit tests, and use mock implementations of the data store interfaces. Da…

Strong choice! My dream is for AuthN to provide authentication and account functionality for folks who have not yet invested in an API gateway, and then seamlessly plug in when the…

I would dearly love that! The answer is not yet. Can you recommend any testers that are OSS-friendly? My current plan is to set up a HackerOne page. I know that bug bounties don't …

> Dex is NOT a user-management system, but acts as a portal to other identity providers through "connectors." > ORY Hydra is not an identity provider (user sign up, user log in, pa…

Auth0 is top-notch SaaS. I have only good things to say about their product. Aside from being OSS, one major difference is that Keratin AuthN is purely an API. It's optimized for c…

I'm currently investing in JWT and have not done enough research on SAML to make it part of my plans. Happy to learn more.

I'd love to fill that in! If anyone would like a comparison, please add links in this thread and I'll reply. Later, I can collect it into a published page.

Oh? Seems like you still want to support old client versions, which means retaining the fragments that they reference. The question then is what implications that has on a server -…

I'd be interested to read an analysis of how this compares to the backends-for-frontends pattern. Also, it seems like Relay Modern reintroduces API versioning, but automates it beh…

> using HMAC SHA-256 HMAC is great for monolithic architecture, but I've quite enjoyed using asymmetric RS256. I don't think that's something AS::ME offers.

1. The reason AS::ME can be that nice is because it assumes a monolithic architecture and a single framework. For example, AS::ME relies on shared secrets, which I think makes it u…