Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shopify implemented its secure authentication service

engineering.shopify.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: How Shopify implemented its secure authentication service

#41

Post by corford »

pm90 wrote: post #22
corford wrote: post #20

Earlier quoted context omitted.

Another solution is OpenLDAP (or JumpCloud) at the root and then supporting software: OpenLDAP ├── PrivacyIDEA (TOTP/MFA with LDAP auth backend) ├──---└── SAML iDp (e.g. SimpleSAMLphp or Shibboleth) for SSO: AWS, Google, Github, Atlassian, Snowflake, Azure etc. ├── Dex (https://github.com/dexidp/dex) for anything that wants Oauth flow ├── Native LDAP for apps that support it (e.g. Metabase, Grafana) ├── Any other cus…

I don’t think anyone building a modern identity solution should base it on openldap. LDAP is amazing as an identity provider in a data center, but does not offer support for modern authentication methods like oath and oidc. As such, it’s not a very good base for creating your organizations identity. I’m happy to be proven wrong about this. I love open standards and protocols.

I think you've misunderstood my comment. LDAP gives you an extremely well supported back end from which to easily extend to virtually any form of authZ, including oauth.

Re: How Shopify implemented its secure authentication service

#42

Post by cutler »

save_ferris wrote: post #27
uyuioi wrote: post #18

Earlier quoted context omitted.

Hopefully crystal Lang will make its way into these ruby heavy shops. They’ll get 100x performance without needing to really think in a whole different programming experience.

I would love to see this happen, but I don't think it's realistic anytime soon. Crystal just doesn't have the community that ruby has, and as teams reconsider certain aspects of their applications, languages like Elixir and Go make way more sense. Creating a compiled language with similar syntax to Ruby is great, but there's so much more involved than just that if you're talking about building a serious, commercial p…

Kotlin is a good transition language from Ruby. Concise with a nice balance between FP and OOP and all the scaling benefits of the JVM.

Re: How Shopify implemented its secure authentication service

#43

Post by nulbyte »

pm90 wrote: post #22
corford wrote: post #20

Earlier quoted context omitted.

Another solution is OpenLDAP (or JumpCloud) at the root and then supporting software: OpenLDAP ├── PrivacyIDEA (TOTP/MFA with LDAP auth backend) ├──---└── SAML iDp (e.g. SimpleSAMLphp or Shibboleth) for SSO: AWS, Google, Github, Atlassian, Snowflake, Azure etc. ├── Dex (https://github.com/dexidp/dex) for anything that wants Oauth flow ├── Native LDAP for apps that support it (e.g. Metabase, Grafana) ├── Any other cus…

I don’t think anyone building a modern identity solution should base it on openldap. LDAP is amazing as an identity provider in a data center, but does not offer support for modern authentication methods like oath and oidc. As such, it’s not a very good base for creating your organizations identity. I’m happy to be proven wrong about this. I love open standards and protocols.

> LDAP is amazing as an identity provider in a data center, but does not offer support for modern authentication methods like oath and oidc.

I don't think lack of support for OAuth is a problem here. OAuth is specifically designed to obtain access to an HTTP service[1], and OpenID Connect is specifically designed for OAuth. LDAP is not an HTTP service.

[1]: https://tools.ietf.org/html/rfc6749

Re: How Shopify implemented its secure authentication service

#44

Post by chrisseaton »

rurounijones wrote: post #37
chrisseaton wrote: post #26

Earlier quoted context omitted.

> without needing to really think in a whole different programming experience But Crystal has entirely different semantics to Ruby. They look vaguely similar at a superficial level, but the semantics are not even remotely similar.

Maybe but depending on what you are doing they are minor considerations. I am porting a relatively simple ruby app to Crystal to see how it is and most of it is copy/paste and then some fixing and adding type definitions where needed. The only issues I have had are where I am using a rubygem that doesn't have a crystal counterpart. For example a pretty simple Gem that connects to a socket and parses incoming data was…

If its so simple to port Ruby code to Crystal, then how come nobody has gotten around to porting Rails to Crystal yet?

Re: How Shopify implemented its secure authentication service

#45

Post by Nextgrid »

jammygit wrote: post #31
eropple wrote: post #19

Earlier quoted context omitted.

PHP is rarely considered "old school." It's considered bad. And not without reason given its history of hostility to its own developers and the sysadmins who have to manage it. I think pretty much everyone has acknowledged that it's improved. Where opinions differ is in how much it has improved and whether that's enough to entertain its use (my answers to which are "not enough" and "not even if you paid me", respecti…

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

Raw PHP without a framework is awful. With a framework it’s decent.

Re: How Shopify implemented its secure authentication service

#46

Post by rurounijones »

chrisseaton wrote: post #44
rurounijones wrote: post #37

Earlier quoted context omitted.

Maybe but depending on what you are doing they are minor considerations. I am porting a relatively simple ruby app to Crystal to see how it is and most of it is copy/paste and then some fixing and adding type definitions where needed. The only issues I have had are where I am using a rubygem that doesn't have a crystal counterpart. For example a pretty simple Gem that connects to a socket and parses incoming data was…

If its so simple to port Ruby code to Crystal, then how come nobody has gotten around to porting Rails to Crystal yet?

Please re-read what I said. I never claimed it was easy to port in every situation.

I merely pointed out that "depending on what you are doing they (semantic differences) are minor considerations." and then gave an example where that was the case with a simple application I was working.

If you want a more complicted library that was ported from Ruby to Crystal then you can also look at Sidekiq ( https://www.mikeperham.com/2016/05/25/sidekiq-for-crystal/ )

Re: How Shopify implemented its secure authentication service

#47

Post by danmur »

IfOnlyYouKnew wrote: post #38
jammygit wrote: post #31

Earlier quoted context omitted.

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

It's... ugly? I started with PHP, like many. And the documentation was excellent, as were deployment options. But even though familiarity tends to breed sympathy, it took me only five minutes of seeing Ruby to question why I ever put up with PHP. Just the need to prefix $variables alone is off-putting, and so were the inconsistancies in style. There were camelCase() functions, but also under_score(). Sometimes it was…

For me (php5, older now I know) it was things like create_function() taking a string. It was (is? dunno) an ugly and crude language, no subtleties in the syntax, just warts. I'm firmly of the belief you can make good things with any language but I don't feel any desire to make things with PHP when there's other good options.

Re: How Shopify implemented its secure authentication service

#48

Post by [deleted] »

rurounijones wrote: post #46
chrisseaton wrote: post #44

Earlier quoted context omitted.

If its so simple to port Ruby code to Crystal, then how come nobody has gotten around to porting Rails to Crystal yet?

Please re-read what I said. I never claimed it was easy to port in every situation. I merely pointed out that " depending on what you are doing they (semantic differences) are minor considerations." and then gave an example where that was the case with a simple application I was working. If you want a more complicted library that was ported from Ruby to Crystal then you can also look at Sidekiq ( https://www.mikeperh…

[deleted]

Re: How Shopify implemented its secure authentication service

#49

Post by shiv86 »

Nextgrid wrote: post #15
ivankolev wrote: post #2

So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.

Remember that the hyped-up companies you hear about on HN & other social media aren't the entire world. There are plenty of companies out there that stay quiet and outside of the spotlight and use the language just fine. The same applies for PHP and other languages that are considered (unfairly IMO) "old-school".

I avoided php and its ecosystem like a plague for the longest time. However the who eco-system has evolved including the language e.g. functional paradigm (closures) and syntactic improvement (arrow functions). When you combine this with a modern web framework like php Laravel it is an absolute pleasure to work with, specifically as a monolithic for rapid application development, which is great for MVPs and ensuring you have product market fit. I am not sure how this translates over time to a micros-services. However if you're starting to writing a new application I would definitely recommend php + laravel for rapid application development. I say this relative to my extensive experience with nodejs express/java spring boot.

Re: How Shopify implemented its secure authentication service

#50

Post by ksec »

noodle wrote: post #4
ivankolev wrote: post #2

So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.

IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..

I believe AirBnB and Groupon are off Rails ( And Ruby ).

So the big one for Rails are Shopify, Github, Cookpad, Gitlab. For Ruby ( Not Rails ) That would be Stripe.

Post reply on HN