Live data from Hacker News

Okta's NextJS-0auth troubles

joshua.hu

81–90 of 167 posts

Re: Okta's NextJS-0auth troubles

#81
post #10

IANAL but unfortunately, I think the fix itself shown here might be too simple to actually clear the bar for copyright eligibility. (And in fairness to copyright law, it is basically the only sane way to fix this.) That means that there's probably not much you can really do, but I will say this looks fucking pathetic, Okta.

I'm more confused by the fact that the OP freely submits a PR into an open source repo but then wants to use "copyright" because the code he submitted ended up being used under the wrong name, which was then corrected.

Licensing your code under open source licenses does not nullify your rights under copyright law, and the license in this case does not waive any rights to attribution.

It would indeed be copyright violation to improperly attribute code changes. In this case I would absolutely say a force push is warranted, especially since most projects are leaning (potentially improperly) on Git metadata in order to fulfill legal obligations. (This project is MIT-licensed, but this is particularly true of Apache-licensed projects, which have some obligations that are surprising to people today.) A force push is not the end of the world. You can still generally disallow it, but an egregious copyright mistake in recent history is a pretty good justification. That or, literally, revert and re-add the commit with correct attribution. If you really feel this is asking too much, can you please explain why you think it's such a big problem? If it's such a pain, a good rule of thumb would be to not fuck this up regularly enough that it is a major concern when you have to break the glass.

Re: Okta's NextJS-0auth troubles

#82
post #79
post #49

Earlier quoted context omitted.

For your average enterprise it really is that simple. Register some IDPs. Connect a backend. Add some clients over time. Yes, you need someone to wear the IAM admin hat. But once you get it configured and running it requires 0.1 FTE or less (likely identical to whatever your Okta admin would be). Not worth 6+ figures a year and exposure to Okta breach risk.

No, it isn't "simple". Protecting your IdP is critical and not easy. Yes, creating a SAML integration is easy, but that's only one piece of the puzzle.

[deleted]

Re: Okta's NextJS-0auth troubles

#83
post #79
post #49

Earlier quoted context omitted.

For your average enterprise it really is that simple. Register some IDPs. Connect a backend. Add some clients over time. Yes, you need someone to wear the IAM admin hat. But once you get it configured and running it requires 0.1 FTE or less (likely identical to whatever your Okta admin would be). Not worth 6+ figures a year and exposure to Okta breach risk.

No, it isn't "simple". Protecting your IdP is critical and not easy. Yes, creating a SAML integration is easy, but that's only one piece of the puzzle.

Paying Azure a little bit to run an AD instance for you, IF you need to run your own IDP (a big if), is not a bad play and does not prevent you from saving lots of money by not using a dubious product like Okta.

Re: Okta's NextJS-0auth troubles

#84
post #42
post #27

Earlier quoted context omitted.

Sadly many people will spend a million dollars to use Okta for their 10,000 logins/day (read: OIDC is not scary, and advanced central authorization features (beyond group memberships) are a big ole YAGNI / complexity trap.

Running your own local AuthN/AuthZ is more than just 'install it on a box in the closet'. I don't blame anyone for letting one of the giants do this on their behalf -- they have the expertise, though I agree I wouldn't touch Okta.

Running your own AuthN/AuthZ with an off-the-shelf OSS is very straight-forward (as a SaaS product at least) and isn't any more burdensome from a security perspective than what you're already doing for your core service.

This isn't email.

Re: Okta's NextJS-0auth troubles

#85
post #56

I find it funny that this seemingly fictitious person Simen A. W. Olsen my@simen.io will forever be engraved as a co-author of a one-line change in the nextjs-auth0 repo.

https://who.is/whois/simen.io He's not fictitious I think.

Simen Olsen is not fictitious, but the "my@" email/username seems to be. Zero hits on DDG, and only this article comes up in Google Search.

Re: Okta's NextJS-0auth troubles

#86

Okta is, if you may excuse my French, straight garbage.

Why if I may ask?

It's a fair question. I found them way better to implement SSO in my small startup than OneLogin.

Using Auth0 in apps, I find their documentation bafflingly difficult to read. It's not like being thrown in the deep end unexpected to swim. It's like being injected at the bottom of the deep end.God help the poor non-native English speakers on my team who have to slog through it.

Re: Okta's NextJS-0auth troubles

#87
post #66

I think it is distasteful and disrespectful to call out an employee by name in this way, regardless of the merit of the rest of the OP's post.

They maintain a public repo.

Yea. I can see what the parent is getting at. However the linked PR's contain the employee name. Their username is the same name mentioned in the article. So it would have been the same even if the author had just mentioned the username instead (which would be completely acceptable in all cases). I think junior employee or not, it's clear that they have the autonomy to check a PR for errors and fix it. So it's very much on them.

Re: Okta's NextJS-0auth troubles

#88
post #84
post #42

Earlier quoted context omitted.

Running your own local AuthN/AuthZ is more than just 'install it on a box in the closet'. I don't blame anyone for letting one of the giants do this on their behalf -- they have the expertise, though I agree I wouldn't touch Okta.

Running your own AuthN/AuthZ with an off-the-shelf OSS is very straight-forward (as a SaaS product at least) and isn't any more burdensome from a security perspective than what you're already doing for your core service. This isn't email.

Running Active Directory is as easy as it gets. Protecting the Golden Ticket is not.

Re: Okta's NextJS-0auth troubles

#89
post #74
post #55

Earlier quoted context omitted.

We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?

If you’re looking for b2b identity, I’m the founder of WorkOS and we power this for a bunch of apps. Feel free to email me, mg@workos.com

We use WorkOS to support some of our offerings but not for our own corporate identity/authentication. I’m not close to the project so I don’t have experience using WorkOS but definitely curious about replacing Okta.
Post reply on HN