The process of open-sourcing BuzzFeed’s single sign-on experience

https://increment.com/security/open-sourcing-buzzfeeds-single-sign-on-process/

by joeyespo • 8 years ago

138 32 8 years ago

minimaxir• 8 years ago

Link to the Show HN of BuzzFeed SSO: https://news.ycombinator.com/item?id=17828293

Maybe I’m missing something, but what is the advantage of maintaining a separate oauth provider (sso-auth)? Since they apparently need to support just google creds, why not let sso-proxy talk to google directly? Why do they need to maintain a separate token infrastructure?

The other (related) question is how the token refresh works - is it tied to the underlying refresh token generated by google, or is it something completely independent?

X-Istence2• 8 years ago

sso-auth allows you to authenticate against Google once, and then any other requests that come to it can be redirect back to the calling application without first hitting Google.

If you registered each new app directly with Google, every time the user visited a new app, they would be redirect to Google to provide permission to the app to log them in, and then be redirected back.

This is described in: https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6

Lx1oG-AWb6h_ZG02• 8 years ago

Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com

That’s the part I’m confused about. They force all sites that need SSO to be under the same subdomain. If they can share the same session cookie, why does each microservice need to redirect at all? Can’t they all use the same oauth app underneath?

luckydata• 8 years ago

I think it's well explained in the article.

Walkman2• 8 years ago

Oh man, my heart breaks when I see yet another auth framework _yet again_ on HN front page, because I work for a company selling Identity Access Management solutions, so I'm not allowed to work on my dream authentication framework [1] for obvious legal reasons. I know a lot of problems regarding authentication and SSO, and I have such a simple solution in my head for a lot of use cases which would be useful for a lot of companies. It is especially annoying because I see how companies pay millions of dollars for fucking terrible solutions I don't think it's fair.

The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do?

[1] https://github.com/kissgyorgy/fancy-auth

notyourwork• 8 years ago

The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do?

Why is this not ethical? A lot of people I know who started their own company usually spun the idea off of experience from their prior employer. If its not ethical why not build it in your current company?

Walkman2• 8 years ago

Why is this not ethical?

Everything I learned about authentication, I learned at this company by digging the code base and understanding our customer's problems. I don't think this is the same like "I worked a lot with XY web framework so I start a startup with XY." I actually learned the domain of authentication only on company time.

If its not ethical why not build it in your current company?

That's a good question I'm not allowed to answer here :D

barkingcat2• 8 years ago

Why is this not ethical? Once you quit your job you are free to work on any project unless you have signed some sort of non-compete and even then, it's probably the non-compete that's non-ethical and illegal.

FPGAhacker• 8 years ago

Depending on the size of the company you worked for, and their legal budget, they may decide to go after you for things you produce even without a non-compete. Or rather they go after ownership of what you produce, claiming it is based on knowledge you gained while performing your job duties for them.

It is far from guaranteed to happen, but it's a risk with a chilling effect.

ComputerGuru• 8 years ago

Ethical != Legal

I worked for a premier backup software company that invested a lot in me. It was a small company and I rose quickly within the ranks to become second after the owner. I greatly respect(ed) the guy and was thankful for what he had given me, when we parted ways I would have given everything to work on my dream backup solution from scratch but knew it would be a below the belt blow to launch a competitor, especially given all I knew about their product, its inner workings, and deficiencies.

It’s been a long time ago now and I would have no qualms about getting into that business today as sufficient time has passed. But I wouldn’t change my decision if I could.

(btw, this is what being an awesome boss looks like.)

theoh• 8 years ago

You have no moral duty to continue acting in the interest of your current employer. This wiki page discusses some of the issues around these situations. https://en.wikipedia.org/wiki/Non-compete_clause

ravenstine• 8 years ago

The only way I could start working on this if I quit my job, but that might not be very ethical thing to do. Any advice what should I do? What would you do?

If you do this, make sure you have enough funds to support yourself for a while, and try to find someone who you can team up with.

Those are the two tips I have from having quit my job recently to work on a passion project. Actually, if you come up with a figure for how much you should have in savings, I'd say aim for double that figure. Every project is more difficult than we anticipate.

devwastaken• 8 years ago

If your idea is good then presenting that idea doesn't seem to be a problem. The issue is when you want to horde it to make a business out of it yourself.

shay_ker2• 8 years ago

This part is really eye-opening on getting an organization to open source their code:

https://increment.com/security/open-sourcing-buzzfeeds-singl...

There's understandably a lot of pressure in open sourcing anything security related. I wonder if that's because this SSO project belongs to Buzzfeed, and not a company that specializes in API gateways, like Kong:

https://github.com/ohioit/kong-oauth-sso

So many devs end up implementing oauth & sso through an API gateway when they move to microservices (we did). I'm just surprised that those features don't exist in popular gateways like nginx & haproxy in the non-enterprise versions. It seems sorely needed!

gammateam2• 8 years ago

We use ethereum address namespace for standardized cryptographic key pairs, and standardized signing.

Through our API we also let people build hosted solutions that let people make familiar usernames and passwords, for people that would find too much friction getting into the ethereum ecosystem.

But its not like you need cryptocurrency to sign.

Any wallet will do, We’ll also release our own eventually which will just be a code fork with our own branding And people wont even know about any of that web3 cryptocurrency stuff.

xfitm3• 8 years ago

Spam?

gammateam2• 8 years ago

why would it be spam?

barbecue_sauce• 8 years ago

Seems strange to me to use OAuth for internal SSO. I'm not sure I would want my Google identity explicitly linked to my corporate identity.

tphan• 8 years ago

The company would create a new Google account for you.

The process of open-sourcing BuzzFeed’s single sign-on experience

Related Stories