81–90 of 116 posts
The article provides a very light history and technically shallow description of OAuth and OIDC so it can advertise Okta. Essentially, "these two protocols are complicated, and you probably don't care, so you should buy Okta." Except this is Hacker News, where caring is fundamental. I'll pass on the Okta advertisement.
Maybe it's aimed at management?
OpenId Connect and OAuth work great and are reasonably designed. The documentation is dense but you'll do fine if you read some of the popular blogs about it summarizing the different flavors.
Their comparison to "rolling your own crypto" is jarring. Rolling != using. You're likely a moron if you write your own crypto library and that applies to not using pre-made OAuth/OIDC libraries as well.
I'm trying to build a simple Python app that authenticates against corporate Okta right now. It's incredibly, painfully difficult. If you search for "Python Okta" you get this: https://developer.okta.com/code/python/ > At this time we do not support official API client libraries (SDKs) for Python. You may fork our legacy Python SDK or join the conversation on this thread and let us know how you’d like to use Okta fro…
I've seen a similar situation with payment processors, where they have SDKs in a variety of languages, but not the one I'm using (our back end is in Perl), so I use the underlying low level API.
Amusingly, it often happens that I look at their Java or PHP SDKs, which involve seemingly a bewildering number of classes and methods, and find that just using their underlying REST API directly is massively simpler, clearer, and takes less code, to the point I don't use their SDKs even if I am working in a language they have an SDK for.
But payment processing is pretty simple. Third party authentication is probably more complicated, and so it could be that the SDKs are doing a lot more than just providing a fairly straightforward wrapper for the underlying low level API.
I'm trying to build a simple Python app that authenticates against corporate Okta right now. It's incredibly, painfully difficult. If you search for "Python Okta" you get this: https://developer.okta.com/code/python/ > At this time we do not support official API client libraries (SDKs) for Python. You may fork our legacy Python SDK or join the conversation on this thread and let us know how you’d like to use Okta fro…
I'm surprised no one has mentioned FusionAuth ( https://fusionauth.io ). It's free, has a Python library, and the features that most apps need. There are a couple of people using Python with FusionAuth right now. The community for FusionAuth is growing quickly and it has an open issue tracker ( https://github.com/FusionAuth/fusionauth-issues ), good docs ( https://fusionauth.io/docs/v1/tech/ ), and many open source p…
I'm curious why the need for Elastic. You already have a database which can be used to search all the user objects. What does Elastic bring to the party other then an extra ops burden?
This is not necessarily a criticism, just trying to understand what went into that architectural decision.
Earlier quoted context omitted.
I'm surprised no one has mentioned FusionAuth ( https://fusionauth.io ). It's free, has a Python library, and the features that most apps need. There are a couple of people using Python with FusionAuth right now. The community for FusionAuth is growing quickly and it has an open issue tracker ( https://github.com/FusionAuth/fusionauth-issues ), good docs ( https://fusionauth.io/docs/v1/tech/ ), and many open source p…
I like what I see provided out of the box by FusionAuth, but I'm rather weary of the hard dependency on Elasticsearch. I'm curious why the need for Elastic. You already have a database which can be used to search all the user objects. What does Elastic bring to the party other then an extra ops burden? This is not necessarily a criticism, just trying to understand what went into that architectural decision.
While Elastic can be a bit cumbersome, we have made bundles that make it simpler to deploy and manage. We have also worked hard to secure it.
I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation). Never building this infrastructure again. What a huge time saver. My company used Okta. We ended up cancelling it as it did not seem…
Is that architecture helpful for a saas app that needs to support users from corporate customers using single sign-on via an OIDC or SAML provider like Azure AD or ADFS? I looked into using Okta or Auth0 for this sort of setup, but both were prohibitively expensive for a saas app.
And it integrates with AAD and ADFS.
We've started using AWS Cognito which provides social logins and oauth and even mobile client and web sdks for integrating. Writing yet another authentication system was just too much and it's great how there's services like okta and aws that are stepping up and letting people just use those and at least in the case of Cognito, at minimal cost.
I've heard that Cognito is very limited in terms of features and can be a headache to get working properly. I haven't used Cognito, but I work for FusionAuth ( https://fusionauth.io ) and we have a number of developers that have switched from Cognito to FusionAuth because we cover more of their use cases outside of plain authentication. Not sure if you have had similar experience with Cognito being limited.
The author of this article cannot be trusted. He regularly writes articles that compare non-best practices of JWT to best practices of other technologies to make JWT look bad. Because of him, I would not trust Okta at all. Take any article by Okta with a grain of salt.
I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation). Never building this infrastructure again. What a huge time saver. My company used Okta. We ended up cancelling it as it did not seem…
Edit: typo