November 2024 Summaries

Authentik is an open source Identity Provider that aims to replace platforms like Okta and Auth0. The company behind it, Authentik Security, operates as a public benefit corporation with the mission of maintaining and improving the open source project. They follow an open core model where some features are exclusive to their enterprise version, but they ensure that core functionality is available in the free version. This approach allows them to collaborate closely with customers and potential customers, providing greater visibility into how issues are addressed. The company's commitment to transparency and active development of the open source project has led to a strong alignment between its business goals and maintaining the quality of the free product.

Okta has recently released a security advisory stating that accounts with usernames longer than 52 characters could authenticate without requiring a password under certain conditions. This issue is due to the use of Bcrypt, a password hashing algorithm, in generating cache keys by combining a user ID, username, and password into one string. This unconventional usage of Bcrypt raises concerns about Okta's security design priorities. The vulnerability was introduced as part of a standard Okta release in July 2024, despite the company's commitment to becoming one of the most secure companies in the world. This highlights the importance of open source and transparent solutions like authentik for identity providers.