Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta's NextJS-0auth troubles

joshua.hu

Post reply on HN
Print view View original

111–120 of 167 posts

Re: Okta's NextJS-0auth troubles

#111

Post by hexbin010 »

inkyoto wrote: post #98
swiftcoder wrote: post #50

Earlier quoted context omitted.

Yeah, I have the misfortune of inheriting a SaaS that built on auth0, and the whole stack is rather clownish. But they tick all the regulatory boxes, so we're probably stuck with them (until they suffer a newsworthy breach, at any rate...)

Okta and auth0 are, fundamentally, two distinct products – conceived, designed, and engineered by entirely separate entities. auth0, as a product, distinguished itself with a modern, streamlined architecture and a commendable focus on developer experience. As an organisation, auth0 further cemented its reputation through the publication of a consistently high-calibre technical blog. Its content goes deeply into advan…

Auth0 spent more time documenting and blogging about standards than documenting their own software. It was a bit bizarre. Their documentation was absent and or terrible IIRC

Re: Okta's NextJS-0auth troubles

#112

Post by Exoristos »

inkyoto wrote: post #105
Exoristos wrote: post #57

Earlier quoted context omitted.

It's not difficult to implement OAuth2. There are good libraries, and even the spec is not complicated. Or use AWS Cognito.

Constructing a new OAuth2/OIDC Identity Provider from the ground up is an undertaking fraught with complexity – and not of the elegant variety. The reasons are numerous, entrenched, and maddeningly persistent. 1. OAuth2 and OIDC are inherently intricate and alarmingly brittle – the specifications, whilst theoretically robust, leave sufficient ambiguity to spawn implementation chaos. 2. The proliferation of standards…

None of this rings true, and I've implemented both OAuth2 and OpenID Connect multiple times, also reading the specs, which are quite direct. I'm sure you're right that vendors take liberties -- that is almost always the case, and delinquency of e.g. Okta is what started this thread.

Re: Okta's NextJS-0auth troubles

#113

Post by solatic »

ecshafer wrote: post #100
lq9AJ8yrfs wrote: post #70

Earlier quoted context omitted.

Among the reasons to leave my last job was a CISO and his minion who insisted spending $50k+ on Okta for their b2b customer and employee authentication was a bulletproof move. When I brought it up, they said they didn't have anyone smart enough to host an identity solution. They didn't have anyone smart enough to use Okta either. I had caught multiple dealbreakers-for-me such dubious / conflicting config settings res…

Keycloak is a great authentication suite, not that hard to configure and rock solid. Ill never understand this thinking.

Auth providers are among the hardest systems to secure. It's not just a question of the underlying code having vulnerabilities - for companies with Internet logins, auth systems (a) are exposed to the internet, (b) are not cache-friendly static content, (c) come under heavy expected load, both malicious (the DDoS kind) and non-malicious (the viral product launch kind), (d) if they ever go down, the rest of the system is offline (failsafe closed).

It's hardly surprising that the market prefers to offload that responsibility to players it thinks it can trust, who operate at a scale where concerns about high traffic go away.

Re: Okta's NextJS-0auth troubles

#114

Post by porker »

Exoristos wrote: post #112
inkyoto wrote: post #105

Earlier quoted context omitted.

Constructing a new OAuth2/OIDC Identity Provider from the ground up is an undertaking fraught with complexity – and not of the elegant variety. The reasons are numerous, entrenched, and maddeningly persistent. 1. OAuth2 and OIDC are inherently intricate and alarmingly brittle – the specifications, whilst theoretically robust, leave sufficient ambiguity to spawn implementation chaos. 2. The proliferation of standards…

None of this rings true, and I've implemented both OAuth2 and OpenID Connect multiple times, also reading the specs, which are quite direct. I'm sure you're right that vendors take liberties -- that is almost always the case, and delinquency of e.g. Okta is what started this thread.

It's an AI bot. One for @dang

Re: Okta's NextJS-0auth troubles

#116

Post by YouAreWRONGtoo »

hexbin010 wrote: post #111
inkyoto wrote: post #98

Earlier quoted context omitted.

Okta and auth0 are, fundamentally, two distinct products – conceived, designed, and engineered by entirely separate entities. auth0, as a product, distinguished itself with a modern, streamlined architecture and a commendable focus on developer experience. As an organisation, auth0 further cemented its reputation through the publication of a consistently high-calibre technical blog. Its content goes deeply into advan…

Auth0 spent more time documenting and blogging about standards than documenting their own software. It was a bit bizarre. Their documentation was absent and or terrible IIRC

[dead]

Re: Okta's NextJS-0auth troubles

#117

Post by inkyoto »

porker wrote: post #114
Exoristos wrote: post #112

Earlier quoted context omitted.

None of this rings true, and I've implemented both OAuth2 and OpenID Connect multiple times, also reading the specs, which are quite direct. I'm sure you're right that vendors take liberties -- that is almost always the case, and delinquency of e.g. Okta is what started this thread.

It's an AI bot. One for @dang

By the same token, if one can use the keyboard, it does not make them a human. Parrots (the non-stochastic kind) and monkeys spring to mind.

Re: Okta's NextJS-0auth troubles

#118

Post by glemmaPaul »

Anyone that uses Okta should be accepting the fact that they have outsourced a huge chunk of responsibility of their job onto an enterprise company.

These github links are not open source projects, these are public readable software projects. You do not control any of it, you have to deal with internal company politics like "# PRs opened", "# Bugs solved" for the developers' next performance review.

Re: Okta's NextJS-0auth troubles

#119

Post by claaams »

Freak_NL wrote: post #59
atonse wrote: post #44

Earlier quoted context omitted.

I agree with the parent post that it's distasteful. There's no value in naming the employee. Whatever that employee did, if the company needed to figure out who it was, they can from the commit hashes, etc. But there's no value in the public knowing the employee's name. Remember that if someone Googles this person for a newer job, it might show up. This is the sort of stuff that can disproportionately harm that perso…

> Remember that if someone Googles this person for a newer job, it might show up. Not to sound too harsh, but this is a person who rudely let AI perform a task badly which should have been handled by just… merging/rebasing the PR after confirming it does what it should do, then couldn't be bothered to reply and instead let the robot handle it, and then refused to fix the mess they made (making the apology void). That…

There also might be some corpo dystopian policy that is forcing them to use AI to do this task.

Re: Okta's NextJS-0auth troubles

#120

Post by claaams »

mananaysiempre wrote: post #21
Aldipower wrote: post #18

WTF is Okta?

An auth integrator, a pretty notable one, mostly (originally?) OAuth I think. Multiple people calling it a trash fire here came as a surprise to me, but I defer to their experience.

People calling it trash and then recommending microsoft was an even bigger shock to the point where I am not convinced that those aren't microsoft AI bots astroturfing this post.
Post reply on HN