Show HN: Open-Source Auth for NextJS / React

https://ory.dev/login-spa-react-nextjs-authentication-example-api-open-source/

by vexcaustic • 5 years ago

107 49 5 years ago

kovek2• 5 years ago

Does passport do something similar?

claystraw14• 5 years ago

Passport.js is an integration library for an identity system - so it's like a client library. As far as I know (it's been a while) it does not solve the "registration" or "password recovery" part itself. The system used in the blog post however does all of those things, from WebAuthn, to 2FA, to linking additional social sign in systems (e.g. Google or Twitter), and so on! So in this example, you could use Passport.js in combination with e.g. Ory Kratos. Hope this helps :)

kovek2• 5 years ago

I thought passport has libraries for the web server also

claystraw14• 5 years ago

Hello, one of the maintainers of https://github.com/ory/kratos (the system used in the blog post) here :) We started Ory Kratos because we saw so many developers struggle with OAuth2 and OpenID Connect. If you have any questions around application auth, OAuth2, or Go, open source I'll try to do my best to answer them accurately!

mjepronk2• 5 years ago

Thank you for working on this interesting open source product.

I have some questions:

- Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations?

- Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)?

- Do you support SAML 2.0 clients?

- Do you have a REST API which can be used to create / deactivate users?

claystraw14• 5 years ago

Thank you for these questions! First of all I want to say that Ory Kratos is built for customer facing authentication first, so many of the enterprise requirements (e.g. LDAP integration) are still missing. Our vision is to build the de-facto open standard for auth, so enterprise IAM is on the roadmap. It just needs time & community feedback to get there :)

To answer your questions:

- Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations?

Depends how you interpret multiple organizations. If those are distinct users (meaning the same person has a profile in org A and org B and does not reuse them), so a true multi-tenant system, then this is not built in and we do not plan to add it.

Running Ory Kratos is very cheap in terms of resources (few MB of ram and no CPU on idle) so it's very affordable to spin up another instance. This doesn't work well for fully-automated deployments such as SaaS systems, but it does work if you are thinking about corporate systems.

You might also look for Ory Cloud, where you can deploy a new Ory Kratos instance with a simple API call.

- Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)?

Yes! Right now we only support OpenID Connect and OAuth1/OAuth2 delegation but more to come.

- Do you support SAML 2.0 clients?

Not yet, but there's an active design document with discussions on different implementation scenarios.

- Do you have a REST API which can be used to create / deactivate users?

Creation - absolutely! Deactivation is not yet available as an API but identity state is already implemented, so adding it is really just a few lines of code.

There are also endpoints for revoking all active sessions which logs out users immediately of one to all systems.

mooreds4• 5 years ago

- Do you support SAML 2.0 clients?

There be dragons.

(Disclosure: I work for FusionAuth.)

Funny story. We had a client doing a SAML integration using HTTP-redirect bindings. It worked when you turned off request signature verification (which is fine for testing, but is like using alg="none" for JWTs, a non-starter in production), but failed when that was turned on. We dug in with the client and another vendor, set up some test servers, and identified the bug[0]. Turns out that you can't canonicalize the signature's URL encoded form, because both uppercase and lowercase hex values are allowed, by the SAML spec.

Our open source SAML library[1] has been around for years and used by many clients in FusionAuth and our other projects. It'd never run into this particular edge case. It is a wild west out there in SAML land and it takes years to build a bulletproof implementation. Ory folks, if you can leverage an existing implementation rather than rolling your own, I'd highly advise that approach.

That is also to say nothing of the incoming privacy/cookie limitation changes that are coming in the next few years. This will unfortunately probably negatively affect SAML, which is not a specification that has evolved much. If this is of interest to you, I'd recommend the Federated Identity W3C community group[2].

That said, FusionAuth supports SAML in many forms[3]. SAML support varies across vendors and implementations, but other providers like Keycloak and IdentityServer do so as well.

0: https://github.com/FusionAuth/fusionauth-issues/issues/1496

1: https://github.com/FusionAuth/fusionauth-samlv2

2: https://www.w3.org/community/fed-id/

3: https://fusionauth.io/docs/v1/tech/core-concepts/integration...

dotancohen2• 5 years ago

Another top-level comment mused:

  > I found it hard to quickly determine whether Kratos can run completely
  > self-hosted, or that there's always some connection to Ory / Ory Cloud services.

I would appreciate answering that at the proper comment, I'm sure many readers here are very interested in the privacy aspect:

https://news.ycombinator.com/item?id=29330048

claystraw14• 5 years ago

Does https://news.ycombinator.com/item?id=29330103 answer your questions or can I clarify further? :)

arbobmehmood• 5 years ago

Looks neat. Will definitely check this out. May I know, how is this different from NextAuth?

claystraw14• 5 years ago

I have not used NextAuth, so take my analysis with caution. As far as I can tell, NextAuth is similar to Passport.js as it offers many adapters to sign in with different providers (e.g. Twitch or Pipedrive). It is not an identity system though, so it does not have things like "update your profile info" or "link Google to this account". I think this manifests with missing password authentication. Even though that's no longer en-vogue and lots of marketing $$$ go into start ups promoting that passwords are bad, "something you know" (vs something you have, something you are) is still and always will be an important security factor in authentication that will most likely never go away.

If you do want to store users locally, you have some adapters you can use. They leave a lot of room for interpretation (or rather implementation), meaning that you will probably have to implement a lot of stuff from zero!

Ory Kratos is like the system behind the Google, Twitch, or Pipedrive profile management, so it has the database of users and it offers variety of user flows for e.g. updating sensitive information, adding WebAuthn 2FA, managing one's profile, and so on.

To conclude, you most likely will be able to combine NextAuth with Ory Kratos or Ory Hydra if it makes sense for your use case!

p2hari2• 5 years ago

I think the part on DB adapters is right in the sense that NextAuth allows us to use whichever db persistence we need. But if that is handled by Ory. what Db does Ory use? Should we set up our own.?

Also, authentication and authorization are core for an app. If we do authentication here, how does authorization work? Can I bring my own authorization like oso etc.

littlecranky67• 5 years ago

NextAuth has the credentials provider to allow username/password logins [0] - I use it in a project and it works okay-ish. However I too got a weird feeling when I read what the NextAuth team really thinks about a username/password login:

The functionality provided for credentials based authentication is intentionally limited to discourage use of passwords due to the inherent security risks associated with them and the additional complexity associated with supporting usernames and passwords

I cannot disagree more. Using 3rd party auth has a lot of issues such as data privacy (requirement of stating that in your privacy/GDPR policy if you are in the EU), increased user support request when they cannot remember which auth provider they used, or the ever growing cases in which Facebook/Google/Whatnot decide to close someones account without possibility to appeal and effectively shutting them out of your App. Or the risk that if Google/FB/Github might not like your webapp, they can disable auth for your users with the flip of a switch. Me personally, I avoid 3rd party auth for those reasons alltogether.

[0] https://next-auth.js.org/providers/credentials

mooreds4• 5 years ago

Pretty cool. Just a heads up, the links in the section: "build your own login, registration, account settings, account verification (e.g. email, phone, activate account), account verification (e.g. reset password) user interfaces and user flows using dead-simple APIs" all are broken, except the 'login' link.

I'm interested in how you allow folks to customize the login flows (probably because my employer, FusionAuth, offers a competitive product :) ). Is this UX customization solely through custom react components?

Is there any ability to customize the actual login sequence, like Azure ADB2C allows? For example: for install A, I want to ask for login, then password, then MFA. for install B, I want to ask for email domain first, then login and password.

claystraw14• 5 years ago

Thank you! We've updated the links and they should work in a few minutes :)

All of Ory's Open Source software is unique in a way that we strictly follow domain-driven design. Solve one problem only, but solve it extremely well, and solve it in isolation. Ory Kratos (and other Ory Projects) are API only. The UI is up to you. You can use Ory for CLIs, fridges, TVs, native mobile apps, Java Server Pages, and React apps.

So, you're also free to choose the UX for your users with a very high degree of freedom - something we found very frustrating before we started working on Ory. Of course, there are some limitations (as always in software) but we try to focus them around security and not how we interpret that sign up flows should look like.

For those who just want something to work, we have templates one can use to get off the ground in a few minutes!

rapnie• 5 years ago

I found it hard to quickly determine whether Kratos can run completely self-hosted, or that there's always some connection to Ory / Ory Cloud services.

claystraw14• 5 years ago

Both! :)

Ory Cloud is still in it's early phases and we have not been very good at communicating it well. Basically, we run Ory Kratos in Ory Cloud and it has full API and configuration and data compatibility with the version that is on GitHub! Our goal is to also allow users to easily switch from self-hosted to ory cloud and back - but it's still a bit of work until we get there.

If you just want to check our Ory Kratos and don't want to use the docker-compose command in the blog post, you can create an Ory Cloud account and use that instead of your local docker environment. That's basically the trade off you're making in a local environment. We have of course tons of plans for Ory Cloud but it's yet too early to share them with a broad audience.

We're currently focusing on gettin all of this much better communicated, and to make it easier to understand what the differences are. So totally get your confusion on it and can only say, we're working on making it better :) Hope this helped at least a little bit!

Sytten3• 5 years ago

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in case of shared machines) or per machine (in case of dedicated instances).

prpl• 5 years ago

It would be nice if you could get some polish on some no-code examples of kratos and hydra working together, beyond a branch in an example app repository

joekrill2• 5 years ago

It's completely self-hostable. You just need to provide a database (PostgreSQL, MySQL, CockroachDB). My impression is Ory Cloud is a hosted instance you can pay for instead of running it yourself (like using a hosted database solution instead of running your own, for example).

chwzr2• 5 years ago

hi, the nextjs integration looks all promising. Especially how fast it is integrated. I wonder if there is a smart way to automatically verify a session and get user details on one of my own api routes?

claystraw14• 5 years ago

Yes absolutely, you can use the Ory SDK's `toSession()` function to resolve a Session Cookie (for browsers) or Session Token (for non-browsers, e.g. native mobile apps) to its identity.

We have on the list to add a section about using Next's new middleware feature to protect API routes. Is that something you'd be interested in?

chwzr2• 5 years ago

yes having the identity on hand by just looking up req.identity would be super neat feature!

joekrill2• 5 years ago

For those looking for a comparison, this is like an alternative to KeyCloak, except you have to "bring your own UI" - which I see as a pro, not a con. I've been evaluating Kratos for some time now, implementing it in a React/Redux/RTK Query app, and I've been really impressed with it. It's still not on parity with the massive feature-set and customize-ability of KeyCloak, but it's getting there pretty quickly. As of the latest release I think it's finally in a state where it can be used in production with little friction. But I'm really looking forward to what the future holds.

oliveralbertini• 5 years ago

What's the diff with Gluu https://gluu.org/ ?

chrisMyzel• 5 years ago

Ory developers emailed me and offered support after I had just expressed interest into the project with someone they know personally - that's a great experience and I have loved watching and using the project since then!

d0100• 5 years ago

When using this, where can a get a deep dive into the architecture and details around the system?

I'm always hesitant to use third party Auth for fear that some bug in our app would generate otps and I won't be able to fix that in an emergency because of a lack of familiarity/access to source code/database

syysilma• 5 years ago

Been working on a webapp on-and-off using Kratos for a bit and it is a massive relief to be able to delegate the hard parts of authentication to something else.

My only real pain points are the docs and the JS SDK - the docs can be rough depending on what you're looking at, and the SDK has no documentation at all. I get that it's automatically generated, but it's enough of a pain to figure out that I resorted to just making the HTTP requests myself.

Show HN: Open-Source Auth for NextJS / React

Related Stories