Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supabase Auth: SSO, Mobile, and Server-Side Support

supabase.com

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#11

Post by kiwicopple »

no_wizard wrote: post #8
kiwicopple wrote: post #7

Earlier quoted context omitted.

The pricing is listed in the "Single Sign-On (SAML 2.0)" row on the pricing page: https://supabase.com/pricing It's available on the Pro Tier. You get 50 free users, then $0.015 per additional MAU. We always aim for simple, transparent, and pricing - we're hoping this is a good balance. And just to be clear, this is for building SSO for your own apps, this is not SSO for the supabase platform (which we're still figur…

Awesome and Awesome! I'm distinctly looking at it from an application point of view right now, SSO just made Supabase very attractive, as well as the SOC Type 2 certification recently announced (yesterday iirc). These were hurdles for our customers, so I'm checking this out with great interest. Great job team! EDIT: With Regards To The SOC Certification a short announcement might be useful for linking purposes.

yes, we now have SOC2 Type2.

It wasn't much of an announcement, just a comment: https://news.ycombinator.com/item?id=35526018

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#12

Post by kiwicopple »

bennyp101 wrote: post #9
kiwicopple wrote: post #4

Earlier quoted context omitted.

any particular feature that you were waiting for in this release? I want to highlight from my comment[0] that PKCE will be rolling out progressively (starting next week). You can reach out to the support team if you want it enabled immediately on any of your projects [0] https://news.ycombinator.com/item?id=35555385 [1] support: https://app.supabase.com/support/new

The `SAML 2.0, for developers can add SSO to their own apps` - I was looking at using BoxyHQ for it, but didn't really want another moving part, so this nicely fills in that space!

good luck building and let us know if you get stuck.

BoxyHQ is also a fantastic product, and their developers have contributed OAuth providers and patched to Supabase Auth. I highly recommend it if you are looking outside the Supabase ecosystem.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#13

Post by kiwicopple »

no_wizard wrote: post #10

I think this question deserves a separate thread: Is it possible to see some working examples with some of the big SSO providers, e.g. integrating with Okta, Duo and AD installations in particular (like Azure AD and standard ActiveDirectory) in the documentation? This would go a long way for smaller app developers to get SSO into their apps, even if the examples aren't exhaustive its a starting point. I have found (h…

> I have found (having done SSO integrations before) that it can be really opaque sometimes reading their API documentation to add support to for such platforms.

Our auth team agrees. We have some docs which you can use as a starter for Azure[0], Google[1], and Okta[2]. These are for our own platform, we'll repurpose them into guides for you to use.

We also have full SAML docs[3], and an example in a PR[4]. You can see the example in action inside the video on the blog post

[0] Azure: https://supabase.com/docs/guides/platform/sso/azure

[1] Google: https://supabase.com/docs/guides/platform/sso/gsuite

[2] Okta: https://supabase.com/docs/guides/platform/sso/okta

[3] SAML: https://supabase.com/docs/guides/auth/sso/auth-sso-saml

[4] SSO example: https://github.com/supabase/supabase/pull/13678

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#14

Post by lelo_tp »

Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that.

If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The only one that exists uses email/password, and the OAuth flow is more convoluted than that :)

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#15

Post by kiwicopple »

lelo_tp wrote: post #14

Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that. If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The o…

thanks for the suggestion. We're working on a full RN example here:

https://github.com/supabase-community/create-t3-turbo

Unfortunately we didn't quite finish it for the launch today, but it will be ready next week and we'll add it to the documentation.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#16

Post by andymitchell »

I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure.

This is perhaps a future topic, but to me it extends out of SSO:

Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase?

I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that makes great sense), my wishlist:

- It should be as simple as an API end point, .approve(auth.jwt(), Array). I.e. be available in Edge Functions, Postgres Functions, and anywhere else.

- Use a policy schema with the most industry support for easier acceptance/integration with the enterprise.

- Flesh out with enterprise-ready policy auditing tools, logging, etc. This is the real time saving for developers.

- I really recommend Tailscale's ideas for better RBAC in https://tailscale.com/blog/rbac-like-it-was-meant-to-be/

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#17

Post by oakesm9 »

> Building apps for iOS requires support for native Sign in with Apple

This part isn't 100% true. It is only a requirement if you have some other form of social login (such as "Login with Facebook") and your app isn't specifically made for using data from that platform (such as a Facebook page managemenet app) [0].

You don't need Sign in with Apple if you only use your own account system.

[0]https://developer.apple.com/app-store/review/guidelines/#sig...

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#18

Post by kangmingtay »

oakesm9 wrote: post #17

> Building apps for iOS requires support for native Sign in with Apple This part isn't 100% true. It is only a requirement if you have some other form of social login (such as "Login with Facebook") and your app isn't specifically made for using data from that platform (such as a Facebook page managemenet app) [0]. You don't need Sign in with Apple if you only use your own account system. [0] https://developer.apple.…

Hi, Supabase Auth Engineer here. Thanks for pointing this out, we'll update our blogpost to reflect this.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#19

Post by paradaux »

What I'd love to see with this is a way to use supabase auth itself as an idP/SAMP provider. Have your tools (back-office tools and what not) written in native supabase, or have multiple supabase projects with the one shared auth system. Could be better UX for Sysadmins than OpenLDAP and so forth.

I'm currently building something similar to just do that on top of supabase for work. Happy to see the developments with Supabase Auth anyway.

Re: Supabase Auth: SSO, Mobile, and Server-Side Support

#20

Post by kiwicopple »

andymitchell wrote: post #16

I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure. This is perhaps a future topic, but to me it extends out of SSO: Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that mak…

> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase?

Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider.

That said, I understand why it's useful to have something more structured like RBAC. We have experimented with a ideas here (specifically ABAC), using a custom libraries/extensions/custom claims[0]. We do something similar internally, but aren't 100% happy with the developer experience and don't plan to release it any time soon.

I'm sure the Auth team won't enjoy me saying this, but I like the idea of Zanzibar. I've seen some experimental Postgres extensions[1] that combine Oso[2] + RLS which I'd love to try when I get time.

[0] custom claims: https://dev.to/supabase/supabase-custom-claims-34l2

[2] Oso + RLS: https://github.com/MFAshby/rls_oso

[1] Oso: https://www.osohq.com/

Post reply on HN