Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Any comprehensive courses on Auth?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 93 posts

Re: Ask HN: Any comprehensive courses on Auth?

#71

Post by justsomehnguy »

woleium wrote: post #57
Arisaka1 wrote: post #55

Earlier quoted context omitted.

As someone interested on upskilling, can you perhaps expand on what you mean by "tinker"? I hear a lot of devs talking about "learning by doing" but I'm trapped in a tutorial hell.

pick an outcome you wish to achieve, break it down into subtasks, then work on them one by one. After completing each subtask, review and re-prioritize the task list As you go along, more tasks will come up that need to be added to the list Edit: perhaps the hard bit is coming up with a thing to achieve? There are some examples in the other comments, such as setup xxx to auth with yyy

> perhaps the hard bit is coming up with a thing to achieve

it is. I don't need a full 2FA TOTP AD integrated SSO for my personal NextCloud instance.

The only way to understand it outside of a job task is to make it for my personal NC instance with usercount of one

Re: Ask HN: Any comprehensive courses on Auth?

#72

Post by woleium »

justsomehnguy wrote: post #71
woleium wrote: post #57

Earlier quoted context omitted.

pick an outcome you wish to achieve, break it down into subtasks, then work on them one by one. After completing each subtask, review and re-prioritize the task list As you go along, more tasks will come up that need to be added to the list Edit: perhaps the hard bit is coming up with a thing to achieve? There are some examples in the other comments, such as setup xxx to auth with yyy

> perhaps the hard bit is coming up with a thing to achieve it is. I don't need a full 2FA TOTP AD integrated SSO for my personal NextCloud instance. The only way to understand it outside of a job task is to make it for my personal NC instance with usercount of one

that’s fine! There are also plenty of charities that would benefit from your help. I used to volunteer to do IT work for the red cross.

Re: Ask HN: Any comprehensive courses on Auth?

#73

Post by haswell »

SushiHippie wrote: post #3

What made me understand these things the most, was setting this up just for myself. For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for…

I'd highly recommend this approach as well. What started as a fascination for me turned into owning a suite of authentication capabilities as a technical PM for one of the SaaS vendors.

The problem with auth is that in practice, it's a lot of messy implementations of insufficient specifications requiring customizations/extensions. Reading a good explainer for say, OAuth, is a great thing to do. But won't be sufficient due to the myriad of weird quirks across various apps/vendors implementation of Auth . Dealing with those quirks helped me more deeply understand the underlying concepts and the intent of the spec.

The messiness of the space really means that to be successful, developing some deeper intuitions about how everything fits together can be extremely helpful. And to do this, I think that just playing with auth - a lot - is one of the best ways to develop these intuitions.

I personally liked to spin up dirt simple Express.js apps, and then I'd wire up a sparse UI to the auth endpoints for some vendor, doing a barebones implementation of each thing needed to satisfy the auth protocol used. This really cemented the concepts for me and gave me a library of code that I could easily copy and tweak to experiment with something else.

I also read a lot of blog posts, watched a lot of YouTube videos, and went to an Auth conference or two.

Re: Ask HN: Any comprehensive courses on Auth?

#75

Post by Keyframe »

davedx wrote: post #9

I’ve learned a lot about these things by working on a project using Ory Kratos. The documentation is a bit patchy but it’s open source so you can dive into the gritty details of how a fairly large id provider implements the various aspects of OAuth and so on. (One nice thing about Azure Active Directory is that it supports OAuth2 integrations so if you understand and can implement OAuth2 then you can also implement A…

Another vote for Ory setup. It forces you a bit to go through it on your own, but you also learn a lot. There's Kratos for authentication, as well as Hydra for federated authentication. Then, there's also Keto for authorization which is really nice and more flexible than Keycloak in certain things, and ultimately there's also Oathkeeper if you want things to be transparent to application developers.

for example if you need roles defined per client and you have a lot of clients. In Keycloak that would be realm(s) and it's not really designed to have a lot of those. In Keto world it's all a function of queries, which admittedly can also be a bit of a challenge if you need to cache it and be part of a fast response chain (like high speed API).

Re: Ask HN: Any comprehensive courses on Auth?

#78

Post by shadowbanned4 »

mooreds wrote: post #46
shadowbanned4 wrote: post #45

Earlier quoted context omitted.

I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.

They still used basic auth across all their apps?

No. They used Oauth. I wrote their entire Oauth system. And it was a nightmare reading through Oauth/OIDC specs for something that could be handled trivially with http basic auth.

Re: Ask HN: Any comprehensive courses on Auth?

#79

Post by buzziebee »

mooreds wrote: post #69
bjt wrote: post #64

I think the most important place to start is appreciating the distinction between authentication ("is the person trying to use my application really the person they say they are?", abbreviated "authn") and authorization ("is this person allowed to perform the action they're trying to perform?", abbreviated "authz"). Most of the comments on this page are referring to authentication. It's important to know, but also th…

> Authorization is far less likely to be something you get off the shelf and far more likely to be where you spend significant time Agreed. It is business logic, which means that it is harder to do off the shelf. That said, there are some startups trying to make this work. Here are the ones I'm aware of: * permit.io * cerbos.dev * osohq.com RBAC (role based access controls) can take you a long way for many applicatio…

Just to add another AuthZ approach to your great comment:

ReBAC for Fine Grained Authorization (FGA) is also something that's becoming more common at the moment. Google released their Zanzibar whitepaper explaining how they implement FGA for things like YouTube and Drive and it's lead to a lot of new tooling based upon it.

I'm working on a project at the moment with quite complex document management with various levels of access. Auth0 open sourced their FGA implementation recently as OpenFGA which looks ideal for our use case. As it's all fairly new there isn't much info out there about different ways of implementing it so we're kind of figuring it out as we go.

Re: Ask HN: Any comprehensive courses on Auth?

#80

Post by bjconlan »

FuriouslyAdrift wrote: post #31

For Kerberos, here: https://kerberos.org/software/tutorial.html

I would highly recommend this also,- but firstly you need to understand how it fits into an organisational system.

I founds this YouTube very informative as to how [all these things hang together](https://youtu.be/cUQcNi_obIc?si=HtZ9iLc76KF2iB2L). [This is perhaps relevant for passkeys](https://fedoramagazine.org/fido2-for-centrally-managed-users...)

Alternatively you can go down the OIDC or SAML paths (generally the path of a developer)

While I've worked with keycloak I've always found the [Curity's resources](https://curity.io/resources/openid-connect/) for understanding OIDC core and extensions very good.

The order in which you learn these things isn't really important but they're both important (but really depends on your problem domain)

Post reply on HN