I have heard of keycloak , open source auth platform
any reviews ?
Ask HN: What do you use for authentication and authorization?
101–110 of 247 posts
Re: Ask HN: What do you use for authentication and authorization?
#102Professionals. Hire an expert. If you can't answer these questions yourself (which is fine - it's specialized knowledge separate from the skillset needed for building a useful application), you are lacking critical competence for coding anything handling health information. The security minefield is much much bigger than the login page.
Classic hacker news. Ask for technical advice, get called incompetent.
[deleted]
Re: Ask HN: What do you use for authentication and authorization?
#103For authentication I use Auth0 on the free tier, with a passwordless setup that uses Google OAuth and Microsoft OAuth and allows fallback to emailing a code to a user. We store nothing more than the email address. The great thing about Auth0 is the separation it provides between the authentication layer and the web app, and how if you go down the SaaS route you can allow people to bring their own Auth0 accounts and c…
How do you implement that cache invalidation, assuming a multiple app server environment? Is it something like a separate redis server?
Yes, exactly: you use a fast data store such as redis or memcached.
As a user performs activities, this may involve a scenario requiring escalation or revocation of authorization roles and corresponding permissions. Invalidate cache at this moment. Lazy cache updated authorization info upon next request.
(I authored Yosai)
Re: Ask HN: What do you use for authentication and authorization?
#104Earlier quoted context omitted.
You don't need JWT in this case. You can use a normal token with short expiry and some mechanism to keep it fresh as long as the user doesn't exit the application.
JWT is simpler to implement and more scalable than the sessionId approach so why would you use the more complex solution to get an inferior result? With JWT, you only need to do a single database lookup when the user logs in with their password at the beginning... You don't need to do any other lookup afterwards to reissue the token; just having the old (still valid but soon-to-expire) JWT in memory is enough of a ba…
With WebSockets, you also have just one lookup when opening the connection. No scalability issue here.
Re: Ask HN: What do you use for authentication and authorization?
#105Earlier quoted context omitted.
Which is fine to use the same logic, as it’s a robust, easy to understand system. but if you aren’t using JWT then you aren’t using JWT. The parent comment saying “that sounds like JWT” is implying it’s just as bad or has the same shortfalls as using JWT.
The big objection to JWT is that it's a bearer token with no revocation support. If you're going to implement a bearer token with no revocation support, or a custom revocation implementation, anyway, then the criticisms of JWT apply just as much to the system you're building and you might as well just use JWT.
Also, people make a big stink when authentication cookies aren’t marked as HTTPONLY. Storing tokens in localstorage (even sessionstorage) is just as bad but for some reason more accepted.
Re: Ask HN: What do you use for authentication and authorization?
#106Earlier quoted context omitted.
> It's probably better than cookies. Why do you think so? I would guess it's a tradeoff about what you think is more likely to happen. XSS or CSRF. Local storage (and session storage) is vulnerable to XSS. Use a strict content security policy and escape (htmlspecialchars in php and similar functions in other languages) output to combat that. Cookies are vulnerable to CSRF but can't be read from JS if they are http on…
If you mean that HttpOnly for cookies protects against XSS, you are mistaken. The attacker will simply generate requests to the secure endpoints rather than steal the token and use it from somewhere else. HttpOnly does not really protect you against XSS at all .
With "no XSS" I meant a XSS exploit doesn't allow access to the data stored in the cookie. I didn't mean it would protect against XSS. Poor/lazy wording on my part, sorry.
It's true that a attacker simply can generate requests from the XSS'ed browser, my understanding was that the session/token is more valuable to an attacker then only an XSS exploit.
However it seems that someone in the past had the same understanding as me and tptacek disagreed [0]. Oh well. Also reading the linked article [1] (are you the author since you use the same wording?) and it's linked articles it seems both cookies and webstorage are not ideal solutions, but local storage might be preferable since CSRF is not a problem, so one thing less to worry about.
[0] https://news.ycombinator.com/item?id=11898525
[1] https://portswigger.net/blog/web-storage-the-lesser-evil-for...
Re: Ask HN: What do you use for authentication and authorization?
#107It depends on what type of system you plan to support. If it's for a hospital setting featuring many different types of actors, roles, and constraints, this requires a greater level of sophistication.
Beware, authorization is an Alice in Wonderland rabbit hole where one may fall far deeper than one expected to.
A few years ago, I ported Apache Shiro from Java to Python, resulting in The Yosai Project: http://yosaiproject.github.io/yosai
It was a grueling but rewarding experience.
I honored Shiro in name and license, open sourcing everything and using Apache 2. I went even further than Shiro by adding two factor authentication workflow using totp and including starter modules for caching, data store, and integration with the web app I was using (pyramid).
If you choose to use python, or even just want something to learn from and reference, check out Yosai. I put a lot into this work to make it useful for others, entirely on my own.
I spoke with Tobias (podcast init) about the project some time ago: https://www.podcastinit.com/yosai-with-darin-gordon-episode-...
Re: Ask HN: What do you use for authentication and authorization?
#108"This product is going to need to be secure as it will be in the healthcare space (so think oidc)."
Considering most EMRs (or at least the ones with which I've interacted) don't go very far beyond a username/password combo, you're probably fine keeping things simple.
Generally, when in doubt, I'd strongly recommend using some existing auth library instead of trying to roll your own. It's not clear where exactly in the healthcare world your site will fit, but if you're aiming for hospitals, any hospital worth their salt is going to be using Active Directory or something similar, so you'll probably want to find something that can support offloading user identification in that direction (and fall back to username/password if the org doesn't yet have AD).
I don't know your specific jurisdiction, but at least in the US, as long as you're encrypting all your data (both at-rest and in-transit) and aren't doing anything egregiously stupid (plaintext passwords, single shared password for everyone, literally selling patient data on the Dark Web, etc.) you should have a pretty hard time violating HIPAA, and you'll already be on-par with most extant medical systems. Any further hardening on the authentication front (e.g. specific session management strategies) will just be icing on the security cake.
If you haven't already, I'd suggest reviewing NIST's guidelines for system security; most official HIPAA reference materials point toward NIST guidelines, and most hospitals will tend toward that direction as well.
Re: Ask HN: What do you use for authentication and authorization?
#109I have heard of keycloak , open source auth platform any reviews ?
Currently integrating Keycloak as auth service for multiple existing projects. It's very advanced, many use cases and configurations are possible. We are in the middle of the migration but so far it hasn't been hard to integrate.
It's a rather large dependency so I won't recommend it for a single project with straight forward auth requirements.
Re: Ask HN: What do you use for authentication and authorization?
#110Ory Hydra
Open source OAuth / OpenID connect server
The docs, API and Docker images make it really easy to start developing against. Then the Docker images and database migration tools make it easy to deploy into our production infrastructure.
Also evaluating the other Ory tools like Keto, a policy engine.
The hackability of these is very attractive over closed services like Auth0.