GApps supports Custom SAML app. What's the benefit of using this Oauth2 over SAML2 protocol?
Show HN: BuzzFeed open source SSO
11–20 of 42 posts
Re: Show HN: BuzzFeed open source SSO
#12GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little organizations <3
Re: Show HN: BuzzFeed open source SSO
#13GApps supports Custom SAML app. What's the benefit of using this Oauth2 over SAML2 protocol? https://support.google.com/a/answer/6087519?hl=en
Great question.
We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since BuzzFeed has many remote employees around the world, we needed to support those workflows, so OAuth2 made more sense.
Re: Show HN: BuzzFeed open source SSO
#14GApps supports Custom SAML app. What's the benefit of using this Oauth2 over SAML2 protocol? https://support.google.com/a/answer/6087519?hl=en
Great question. We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since BuzzFeed has many remote employees around the world, we needed to support those workflows, so OAuth2 made more sense.
IMO That's opposite of what I understand. The selling point of Oauth2 is SAML works great on web (mobile browsers included) but not so on apps.
Re: Show HN: BuzzFeed open source SSO
#15GApps supports Custom SAML app. What's the benefit of using this Oauth2 over SAML2 protocol? https://support.google.com/a/answer/6087519?hl=en
Great question. We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since BuzzFeed has many remote employees around the world, we needed to support those workflows, so OAuth2 made more sense.
That doesn't make sense. SAML is only a bunch of POST and redirections as far as the browser is concerned. There is no specific support required from the browser.
Re: Show HN: BuzzFeed open source SSO
#16Earlier quoted context omitted.
Great question. We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since BuzzFeed has many remote employees around the world, we needed to support those workflows, so OAuth2 made more sense.
IMO That's opposite of what I understand. The selling point of Oauth2 is SAML works great on web (mobile browsers included) but not so on apps.
I’ll correct my post above. I meant to say `mobile devices`, not `mobile browsers` . My bad.
The other reason, which I didn’t mention above, but is talked about in the blog post, is we decided to use bitly’s oauth2_proxy as a basis for our solution. This had been widely used in BuzzFeed (we had over 100 auth proxies in place prior to rolling out sso), and so the OAuth flow was something everyone was familiar with.
Re: Show HN: BuzzFeed open source SSO
#17GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Have you contracted an independent pen-testing company to assess your design and implementation?
Why don't people read shit before posting?
Re: Show HN: BuzzFeed open source SSO
#18Earlier quoted context omitted.
Have you contracted an independent pen-testing company to assess your design and implementation?
Why don't people read shit before posting?
Your comment is incredibly unhelpful and does not contribute to the discussion. HN is not the kind of platform to shitpost on.
Re: Show HN: BuzzFeed open source SSO
#19Earlier quoted context omitted.
Have you contracted an independent pen-testing company to assess your design and implementation?
This is mentioned in the article > In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon as clients, to do a more in-depth, week long assessment, with full access to source code and design documents. This found no major issues, which gives us the confidence to open source sso today.
It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.
Re: Show HN: BuzzFeed open source SSO
#20GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?