Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

101–110 of 119 posts

Re: AWS Single Sign-On

#101

Post by fragmede »

dgoldstein wrote: post #49
tanilama wrote: post #31

Earlier quoted context omitted.

Excel needs to go, better wait for it to fade, it is not a modern data analytics system, not at all.

It isn't. But what do you replace it with? Better solutions are likely to only cover a fraction of use cases, so they really need to be stellar to win over users.

It's about the data, and the better solution is to use a database. The problem is that retraining everyone from Excel to use some sort of SQL frontend is not a small problem, and neither is getting the company to commit to operating a data warehouse.

It's really about the data though, and if the database has access to more data, and requires less work from analysts, it becomes a replacement for some work that was previously done in Excel, even if the system still supports exporting to CSV, for importing into Excel for the parts that the system does not support.

The system I am familiar with is Redshift, and we are able to generate daily or hourly graphs for various parts of the business with it.

Re: AWS Single Sign-On

#102

Post by ak217 »

lvh wrote: post #86
ak217 wrote: post #82

Earlier quoted context omitted.

Thanks. Can't say I agree on the basis of this list that JWT/OIDC is equally bad to SAML. SAML is an outdated, ill-designed piece of crap that is a ticking time bomb of an implementation nightmare, in large part because almost nobody truly understands the standard or the security implications of the underlying XML Security standards (having written https://github.com/XML-Security/signxml for much the same reasons you…

Your comments about SAML are valid, but we're not implementing _all of SAML_. We're implementing the tiny subset that we can do safely once that you're actually going to use, once. This sidesteps some of the issues you're referring to. (Also: while I agree dsig is horrendous, I don't think that stops implementors: there's like 2-3 truly unique implementations, mostly libxmlsec1. People regularly write their own JWT b…

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC?

Are there implementation notes or library implementations of SAML and OIDC that you would recommend as good references? I'm aware of Okta's docs, https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet, https://wiki.mozilla.org/Security/Guidelines/OpenID_Connect, and the Google docs you linked, but would like to learn more/find better libraries.

Re: AWS Single Sign-On

#103

Post by tptacek »

mankash666 wrote: post #98
tptacek wrote: post #96

Earlier quoted context omitted.

Yeah, I don't care about these terms at all . I'm happy to get directory integration working, or to proxy SAML from elsewhere (as long as it conforms to the minimal SAML I'm willing to speak).

You should care about these terms while building and marketing software in the space. I'm not saying you're being deceitful, however, almost anyone who read your description assumed your offering to have feature parity with AWS SSO, but the feature list probably is closer to AWS Cognito. An open alternative to Cognito might be sufficient for most, but is still not the same as a comprehensive SSO manger

I think we're just going to put it on Github for now and say "here's this thing and here's what it can do" and not worry too much about an Eric and Al Ries-approved Positioning marketing strategy. Not giving a shit about stuff is pretty liberating. :)

Re: AWS Single Sign-On

#104

Post by tptacek »

ak217 wrote: post #102
lvh wrote: post #86

Earlier quoted context omitted.

Your comments about SAML are valid, but we're not implementing _all of SAML_. We're implementing the tiny subset that we can do safely once that you're actually going to use, once. This sidesteps some of the issues you're referring to. (Also: while I agree dsig is horrendous, I don't think that stops implementors: there's like 2-3 truly unique implementations, mostly libxmlsec1. People regularly write their own JWT b…

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP ? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC? Are there implementa…

I hope both SAML and OIDC go away.

Re: AWS Single Sign-On

#105

Post by lvh »

ak217 wrote: post #102
lvh wrote: post #86

Earlier quoted context omitted.

Your comments about SAML are valid, but we're not implementing _all of SAML_. We're implementing the tiny subset that we can do safely once that you're actually going to use, once. This sidesteps some of the issues you're referring to. (Also: while I agree dsig is horrendous, I don't think that stops implementors: there's like 2-3 truly unique implementations, mostly libxmlsec1. People regularly write their own JWT b…

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP ? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC? Are there implementa…

Sorry for the term confusion: TinySAML is what I’m informally calling the tiny subset of SAML we’re choosing to care about. Neither full-SAML nor full-OIDC fit in my head; I’ll also concede that full-SAML is much more complicated than full-OIDC, but that doesn’t matter: narrowing scope is much more effective for SAML than OIDC.

I hope both protocols become obsolete. SAML may not be the future, but it’s definitely the present. I’m not convinced OIDC is materially better.

‘tptacek will have much more informed opinions about relative SAML library quality so I’ll leave that to him.

Re: AWS Single Sign-On

#106

Post by ak217 »

tptacek wrote: post #104
ak217 wrote: post #102

Earlier quoted context omitted.

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP ? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC? Are there implementa…

I hope both SAML and OIDC go away.

And are replaced with what?

Re: AWS Single Sign-On

#107

Post by lvh »

ak217 wrote: post #106
tptacek wrote: post #104

Earlier quoted context omitted.

I hope both SAML and OIDC go away.

And are replaced with what?

We don’t think it’s been written yet. But punchline: don’t support every combination of encryption and signing; sign in 1 place and 1 place only, tiny set of protocol versions...

Re: AWS Single Sign-On

#108

Post by tptacek »

lvh wrote: post #105
ak217 wrote: post #102

Earlier quoted context omitted.

Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP ? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC? Are there implementa…

Sorry for the term confusion: TinySAML is what I’m informally calling the tiny subset of SAML we’re choosing to care about. Neither full-SAML nor full-OIDC fit in my head; I’ll also concede that full-SAML is much more complicated than full-OIDC, but that doesn’t matter: narrowing scope is much more effective for SAML than OIDC. I hope both protocols become obsolete. SAML may not be the future, but it’s definitely the…

The actual Go package is "trivialsaml". :)

Re: AWS Single Sign-On

#109

Post by actualanswer »

reilly3000 wrote: post #20

Sad day for Saml SSO vendors I guess. I know I would pick this next time over auth0/stormpath/one login because it’s free.

But would you though? They only integrate with AD and looks like they are trying to address a gap that AWS has with managing access to resources. These other IdaaS have a lot more functionality.
Post reply on HN