Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: BuzzFeed open source SSO

tech.buzzfeed.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Show HN: BuzzFeed open source SSO

#31

Post by itwasntandy »

gknoy wrote: post #23
xeromal wrote: post #17

Earlier quoted context omitted.

Why don't people read shit before posting?

In the blog article, they state: > we have made sso a priority target for penetration testing by researchers on our bug bounty program — we’ve paid bounties for a number of reported issues! While that makes it clear that they cared about penetration testing, it isn't what the person was asking to that you replied to -- they asked if they had contracted with an independent company to do testing. This did not seem to b…

We did talk in the blog article about engaging with Security Innovation too.

Re: Show HN: BuzzFeed open source SSO

#32

Post by thomseddon »

We took a slightly different approach to solving a similar problem: https://github.com/thomseddon/traefik-forward-auth

We were already using traefik as a proxy for our docker/swarm clusters and this is a single container drop in to add authentication to every traefik request.

It's still missing a few key features but it can get you started, we're testing the use of a single auth domain (so you don't have to add every internal service domain as a refirect_uri in Google - looks similar to how sso works) internally and we expect to release this shortly once finished.

Additionally, if you want an even lighter weight option, we also use, with great success, cloudflare's lua script on a few services we don't run with docker/traefik: https://github.com/cloudflare/nginx-google-oauth

Re: Show HN: BuzzFeed open source SSO

#34

Post by itwasntandy »

rllin wrote: post #33

a bit ignorant in this area, but how is this functionally different than Google Cloud IAP?

It’s not. We acknowledge that in our blog post, and our approach was definitely influenced by the BeyondCorp philosophy.

However google IAP requires that your infrastructure is all in Google cloud.

Whilst we do use GCP, most of BuzzFeed’s infra is in AWS, we needed a solution which worked for both.

Re: Show HN: BuzzFeed open source SSO

#35

Post by Dowwie »

itwasntandy wrote: post #2

GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!

How have you found working with Go?

Re: Show HN: BuzzFeed open source SSO

#37

Post by solarkraft »

minimaxir wrote: post #25
supuun wrote: post #22

never expected BuzzFeed on HN frontpage (:

BuzzFeed has been on the HN homepage quite frequently. https://news.ycombinator.com/from?site=buzzfeednews.com https://news.ycombinator.com/from?site=buzzfeed.com

Buzzfeed news is ... surprisingly good. The Buzzfeed name is just associated with painfully stupid content.

Re: Show HN: BuzzFeed open source SSO

#38

Post by ashayh »

itwasntandy wrote: post #26
snuxoll wrote: post #20

Earlier quoted context omitted.

Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?

Hey, there were a few reasons behind this. - ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected. - ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/depl…

Is it possible to use this with Nginx auth_request? I use bitlys oauth2_proxy like so because it doesn't support websockets.

Re: Show HN: BuzzFeed open source SSO

#39

Post by itwasntandy »

Dowwie wrote: post #35
itwasntandy wrote: post #2

GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!

How have you found working with Go?

Golang is pretty beloved at BuzzFeed.

It’s one of our two standard languages - the other being Python - and whilst the vast majority of our services are Python, Golang is being used for growing and significant number too.

Touching on my first point, we have observed people enjoy writing Go apps, and it is a great fit particularly where performance and scalability are needed.

Therefore when engineers have moved to another team internally, they often will evangelize Golang to their new team members.

So we expect it to continue to grow and thrive here!

Re: Show HN: BuzzFeed open source SSO

#40

Post by itwasntandy »

ashayh wrote: post #38
itwasntandy wrote: post #26

Earlier quoted context omitted.

Hey, there were a few reasons behind this. - ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected. - ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/depl…

Is it possible to use this with Nginx auth_request? I use bitlys oauth2_proxy like so because it doesn't support websockets.

Maybe - we've not tried it, but I just asked Justin who architected sso, and he suggested that maybe https://github.com/buzzfeed/sso/blob/master/internal/proxy/o... could be used.

However there would be some caveats - like for example `skip_auth_regex` (see https://github.com/buzzfeed/sso/blob/master/docs/sso_config.... ) would not work with this, because the original URI would not be checked.

Post reply on HN