I want, want, want to use Supabase - I yearn for a first party SDK for iOS.
Supabase Auth: SSO, Mobile, and Server-Side Support
21–30 of 68 posts
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#22Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that. If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The o…
[deleted]
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#23Really timely! I was about to start building the Apple sign-in flow for my RN app (already built the Google Sign-in). Supabase makes auth incredibly easy, thank you for that. If you mind me giving some feedback: it took me a while to figure out how to properly build the auth flow with Expo/RN. In the end, I went with Expo AuthSession. IMO, you're missing an easy win with a template/getting-started guide for RN. The o…
thanks for the suggestion. We're working on a full RN example here: https://github.com/supabase-community/create-t3-turbo Unfortunately we didn't quite finish it for the launch today, but it will be ready next week and we'll add it to the documentation.
Oh I didn't see this post awesome, will keep an eye on the repo
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#24I want, want, want to use Supabase - I yearn for a first party SDK for iOS.
We now support Swift: https://supabase.com/docs/reference/swift/introduction
We'll double-down on iOS now that we have shipped native Apple logins.
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#25I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure. This is perhaps a future topic, but to me it extends out of SSO: Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that mak…
> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand w…
Thanks Paul, Oso looks great.
Re: RLS:
Pros
- The simplicity+security is hard to beat
- Supabase is built around it. I really want the purity of just one platform.
Cons (in order)
- Our enterprise customers need regular oversight of policy + logs for their compliance (and our ongoing relationship). RLS doesn't expose that afaik.
- RLS can't control access to API end points in places like Edge Functions (again, afaik). Same for any 3rd party systems you might have mixed in.
- In my experience, RLS has quite a few foot guns in it as schemas migrate and evolve (security gaps open up, or recursion bites you).
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#26I can't advocate Supabase enough. Their combo of openness and elegance in their platform leaves me (a developer/entrepreneur) feeling secure. This is perhaps a future topic, but to me it extends out of SSO: Paul (@kiwicopple), do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? I suspect it's Cerbos or Casbin, but if you ever do it in house (and since you've nailed AuthN that mak…
> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand w…
If you need the flexibility of a system that can model both RBAC and ABAC and you also want you want a Zanzibar-inspired design, SpiceDB[0] is the only option that I know checks all the boxes (disclosure: I'm a maintainer).
The UX definitely isn't optimized for Supabase, but I'd love to learn more about how that could be improved. I suspect it might be complicated if Supabase assumes RLS for everything.
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#27What I'd love to see with this is a way to use supabase auth itself as an idP/SAMP provider. Have your tools (back-office tools and what not) written in native supabase, or have multiple supabase projects with the one shared auth system. Could be better UX for Sysadmins than OpenLDAP and so forth. I'm currently building something similar to just do that on top of supabase for work. Happy to see the developments with…
Hi, Supabase Auth Engineer here. Interesting, just wondering if there's a reason behind choosing to roll your own iDP instead of using one of the big ones out there (Okta, Azure, GSuite) ?
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#28Earlier quoted context omitted.
> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand w…
Thanks Paul, Oso looks great. Re: RLS: Pros - The simplicity+security is hard to beat - Supabase is built around it. I really want the purity of just one platform. Cons (in order) - Our enterprise customers need regular oversight of policy + logs for their compliance (and our ongoing relationship). RLS doesn't expose that afaik. - RLS can't control access to API end points in places like Edge Functions (again, afaik)…
> logs for their compliance
Supabase Logs will be fully-integrated with the rest of the supabase stack. Since the Auth JWT flows through the HTTP Authorization header, into PostgREST, then into Postgres, we can pluck the Supabase User ID out of the JWT and store it alongside every log entry. You will be able to reference/join every authorized action in your database to an authenticated user.
> RLS can't control access to API end points in places like Edge Functions (again, afaik).
also correct, for now. We released the Edge Runtime[0] this week, and plan to use it as a scriptable Proxy.
> In my experience, RLS has quite a few foot guns in it as schemas migrate
A very fair point. We hope that we'll be able to provide some tooling here.
Thanks for all of this feedback - it's incredibly useful. Our team read the HN comments thoroughly and it shapes our ideas for the product going forward. We have some gaps to fill for your requirements, but we'll get there.
[0] Deno Edge Runtime: https://supabase.com/blog/edge-runtime-self-hosted-deno-func...
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#29So if anybody else got excited about multi-tenant SSO but was wondering how to implement it, the docs page is here https://supabase.com/docs/guides/auth/sso/auth-sso-saml.
I'm super excited because as a newcomer to needing to implement that feature, other SaaSes like auth0 were complicated and overwhelmed me.
Since we have Supabase employees here, one thing that isn't clear to me is if OIDC based SSO is supported, or will be?
Re: Supabase Auth: SSO, Mobile, and Server-Side Support
#30So if anybody else got excited about multi-tenant SSO but was wondering how to implement it, the docs page is here https://supabase.com/docs/guides/auth/sso/auth-sso-saml . I'm super excited because as a newcomer to needing to implement that feature, other SaaSes like auth0 were complicated and overwhelmed me. Since we have Supabase employees here, one thing that isn't clear to me is if OIDC based SSO is supported, o…
Supabase Auth Engineer here. We initially started off with the SAML 2.0 protocol since it's the one of the oldest protocols and also one that's used by most enterprises. We're definitely looking to add OIDC based SSO support soon so stay tuned!