Show HN: BuzzFeed open source SSO

https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6

by itwasntandy • 8 years ago

166 31 8 years ago

tech.buzzfeed.com

itwasntandy11• 8 years ago

GitHub repo: https://github.com/buzzfeed/sso

This is our identity aware proxy, which we've been using internally for a year.

The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license.

We'll be keeping an eye on the thread, and happy to follow up to any questions!

andremat• 8 years ago

Have you contracted an independent pen-testing company to assess your design and implementation?

kingbirdy• 8 years ago

This is mentioned in the article

In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon as clients, to do a more in-depth, week long assessment, with full access to source code and design documents. This found no major issues, which gives us the confidence to open source sso today.

itwasntandy11• 8 years ago

Yes, as mentioned in the blog post, we worked with Security Innovation to do a week long security assessment with full access to source code, design documents and endpoints.

We also have a long term consulting arrangement with a widely respected security architect, and they helped review our design and implementation.

Additionally, BuzzFeed has a bug bounty program on hackerone (https://hackerone.com/buzzfeed), and have invited partipating researchers to report on any issues found. We’ve paid out bounties for a number of minor issues, which were addressed prior to open-sourcing.

Additionally, knowing that security is never done, we continue to make it eligible for bounties -- see https://github.com/buzzfeed/sso/blob/master/README.md#securi...

Signez• 8 years ago

Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little organizations <3

itwasntandy11• 8 years ago

thank you - We know from our own experience using other open source projects that having documentation, and guides to get started really helps.

We know there is more to do there too (some of the feedback in this HN post has helped highlight areas we need to improve the docs) and we will be adding to the docs so over the next while.

We will also welcome PRs improving the docs!

snuxoll• 8 years ago

Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?

itwasntandy11• 8 years ago

Hey,

there were a few reasons behind this.

- ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected.

- ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/deploy-with-haste-the-story-of-rig... ).

- when we built this, there were far fewer solutions than there are today. For example, Ory's Oathkeeper ( https://github.com/ory/oathkeeper) was released after we were already using sso internally at BuzzFeed.

thanks!

Dowwie• 8 years ago

How have you found working with Go?

itwasntandy11• 8 years ago

Golang is pretty beloved at BuzzFeed.

It’s one of our two standard languages - the other being Python - and whilst the vast majority of our services are Python, Golang is being used for growing and significant number too.

Touching on my first point, we have observed people enjoy writing Go apps, and it is a great fit particularly where performance and scalability are needed.

Therefore when engineers have moved to another team internally, they often will evangelize Golang to their new team members.

So we expect it to continue to grow and thrive here!

nancyp2• 8 years ago

GApps supports Custom SAML app. What's the benefit of using this Oauth2 over SAML2 protocol?

https://support.google.com/a/answer/6087519?hl=en

itwasntandy11• 8 years ago

Great question. We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since BuzzFeed has many remote employees around the world, we needed to support those workflows, so OAuth2 made more sense.

nancyp2• 8 years ago

IMO That's opposite of what I understand. The selling point of Oauth2 is SAML works great on web (mobile browsers included) but not so on apps.

user5994461• 8 years ago

That doesn't make sense. SAML is only a bunch of POST and redirections as far as the browser is concerned. There is no specific support required from the browser.

supuun• 8 years ago

never expected BuzzFeed on HN frontpage (:

minimaxir• 8 years ago

BuzzFeed has been on the HN homepage quite frequently.

https://news.ycombinator.com/from?site=buzzfeednews.com

https://news.ycombinator.com/from?site=buzzfeed.com

solarkraft• 8 years ago

Buzzfeed news is ... surprisingly good. The Buzzfeed name is just associated with painfully stupid content.

markovbot2• 8 years ago

Looks super interesting. I'm looking to do something like this for my personal stuff, but I'd rather avoid the dependency on Google. Does anyone have suggestions for how to set something like that?

itwasntandy11• 8 years ago

Right now we have a dependency on Google as an OAuth2 provider, as that's what we use internally at BuzzFeed. However we've designed sso to allow us to easily add other providers.

For example, there's this task ( https://github.com/buzzfeed/sso/issues/9 ) to create a default provider without Google dependencies for test purposes.

We'd also welcome PRs adding other providers and believe any OAuth2 provider should be straight forward to add.

markovbot2• 8 years ago

Cool, thanks for letting me know. I'll have to research this more.

wrboyce• 8 years ago

I have used https://github.com/bitly/oauth2_proxy with success, and it supports a variety of providers.

thomseddon• 8 years ago

We took a slightly different approach to solving a similar problem: https://github.com/thomseddon/traefik-forward-auth

We were already using traefik as a proxy for our docker/swarm clusters and this is a single container drop in to add authentication to every traefik request.

It's still missing a few key features but it can get you started, we're testing the use of a single auth domain (so you don't have to add every internal service domain as a refirect_uri in Google - looks similar to how sso works) internally and we expect to release this shortly once finished.

Additionally, if you want an even lighter weight option, we also use, with great success, cloudflare's lua script on a few services we don't run with docker/traefik: https://github.com/cloudflare/nginx-google-oauth

rllin• 8 years ago

a bit ignorant in this area, but how is this functionally different than Google Cloud IAP?

itwasntandy11• 8 years ago

It’s not. We acknowledge that in our blog post, and our approach was definitely influenced by the BeyondCorp philosophy.

However google IAP requires that your infrastructure is all in Google cloud.

Whilst we do use GCP, most of BuzzFeed’s infra is in AWS, we needed a solution which worked for both.

Show HN: BuzzFeed open source SSO

Related Stories