March 2023 Summaries

JSON Web Tokens (JWTs) have gained widespread adoption as the dominant standard for managing authentication requests due to their improved security over single strings and stateless quality. A JWT consists of three parts: a header with declarations such as "alg" and "typ", a payload containing claims about the user and token, and a verified signature created using a secret key or public/private key pair. JWTs have evolved since their initial draft in 2010 and are now widely used in industries and enterprise systems like Netflix, CockroachDB, MongoDB, VMWare, and many others. In authentik, JWTs are used to manage user access with advantages such as cross-services efficiency, automated login, and expiration time setting, making them a highly effective method for enterprises.

Authentik Security, a company built around the open source project authentik, is now almost 6 months old and has a growing staff that will continue to expand the open source product with new releases and develop enterprise-level features. The company aims to strengthen its collaboration and communication with its community of users, who are experts in security and identity management. New features planned for authentik include role-based access control (RBAC), UX improvements, push-notification multifactor authentication, desktop authentication, AI-based risk assessment, and a new plans page that will provide detailed information on pricing and offerings. The company is focused on building strong communication and collaboration processes with its users to gather feedback and prioritize features.

authentik is an open source authentication project built on Python and Django that was initially started as a hobby project in 2018 and later developed into a business called Authentik Security with funding from Open Core Ventures. The project's primary differentiator is its self-hosted delivery model, which appeals to developers who want to customize their authentication solutions. Building authentik with Python and Django enabled the team to hire more developers familiar with these languages, supporting the project's growth. However, the choice of Python and Django also imposed a speed limitation, which was prioritized over performance due to its impact on iteration speed and ease of development. The author argues that speed is not as critical for business applications, especially B2B software, where users often have different expectations and requirements. Instead, the team focused on building a robust product with good architecture, scalability, and user experience design, which has enabled them to make tradeoffs in performance without compromising their core differentiator. The author emphasizes that technology stacks are not static and that migration can be an option if needed, while also stressing the importance of architecting applications well to ensure scalability and long-term performance.

OpenID Connect (OIDC) is a standard that builds upon OAuth 2.0, adding a standard for user identity verification through tokens issued by an IDP, allowing RPs to verify the identity of users. OIDC was introduced in 2014 and has been widely adopted since then, but its broad adoption also increased diversity and fragmentation. To ensure implementation matches the standard, OIDC has a certification program with Conformance Tests that cover edge cases, uncommon features, and positive/negative flows. Deviations from standards can occur, such as VMware's vCenter requiring an encoded JWT access token not specified in the OpenID standard. However, having a central governing body like the OpenID Connect Foundation ensures standards are enforced, validated, and built upon by independent people, making certification easier to verify compatibility with other software. Standards-compliant applications like authentik aim to adhere to these standards while retaining their feature set.