Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use for an authenication/authorization solution

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 10 posts

Ask HN: What do you use for an authenication/authorization solution

#1

Post by durron »

I’m working at an early pre seed startup and building out the product. Every time I visit implementing Identity, I struggle with a good solution. Building it in house is costly and fraught with potential errors, but platforms like Auth0 charge an exorbitant amount per user that’s difficult to do at an early stage of a company. I’m curious to what other people are using in their products.

Re: Ask HN: What do you use for an authenication/authorization solution

#2

Post by romanhn »

Currently using Firebase Auth, which was fairly easy to implement and is free/cheap at high user counts, so is an option for a B2C application, unlike most commercial solutions I ran across.

Cons: difficult (sometimes impossible) to customize, password complexity can't be set (6-letter passwords allowed, wtf), and worst of all - it's Google, so expect appropriate level of care from the company (read: none). Definitely planning to switch out when/if there is traction, but for an early MVP I found it to be quite decent.

Re: Ask HN: What do you use for an authenication/authorization solution

#5

Post by natpalmer1776 »

I would suggest setting up your own hosted auth provider (via e.g. IdentityServer 4) to retain ownership of identity secrets, then use SAML, OIDC, etc. to perform federated authentication with third party authentication and identity providers (e.g. google login, apple login, etc.)

This is more complicated yes, however you are less likely to end up in a situation where a core identity provider unreasonably raising their rates results in either a significantly higher cost-per-user or significant user attrition during provider account migration.

Or if you’re less risk averse just pick a major identity provider such as Auth0 and use their free plan for getting started easily. Many major providers offer “easy” migration away from their competitors and provide extensive documentation for how to integrate with their platform.

Re: Ask HN: What do you use for an authenication/authorization solution

#6

Post by joshxyz »

there are solutions out there like auth0 okta supertokens keycloak openpolicyagent but they all got their own learning curves

personally i would revisit the problem first if my current market really needs a full blown solution or i can get away with simple postgres backend with simple users table and rbac implementation (sometimes it's even just a roles array in server side)

much of it though is addressable once theres a real business need to it, hiring a dev that really knows hows to roll it out is worth the money, or even a consultanf that can guide you through it

Re: Ask HN: What do you use for an authenication/authorization solution

#7

Post by vdelitz »

Is it a B2B or B2C product that you're building? What are the authentication methods you want to support? Do you only require authentication or also authorization or session management?

I think answering these questions first will help you to find a suitable solution in this space, as each provider has different strengths and weaknesses depending on your use case.

Re: Ask HN: What do you use for an authenication/authorization solution

#8

Post by leros »

For a B2B service, I use Auth0. It does cost $20 or so per month for the lowest tier, but when I need to enable enterprise login mechanisms for a single customer, it will be worth every penny to have that be a simple thing to enable versus a whole engineering project.
Post reply on HN