September 2020 Summaries

Scott Plunkett, founder of game server management company Contaim, is using FusionAuth to manage authentication for his application. He chose FusionAuth over competitors due to its flexibility and cost-effectiveness. Contaim uses FusionAuth for user management, OAuth, social sign-on, and two-factor authentication, solving issues such as managing the authentication lifecycle and offering OAuth capabilities. The company runs FusionAuth on a Debian machine behind an ELB, with plans to move to Kubernetes in the future. Despite some minor irritations, Scott praises FusionAuth's benefits and encourages others to share their community stories about using the platform.

The article outlines the implementation of authentication and authorization for an API gateway application, which routes requests to two microservices—a Product Catalog service and a Product Inventory service—using FusionAuth as the authentication server. Designed for an eCommerce scenario, the gateway application manages access to these services, requiring authentication for certain endpoints while allowing public access to others. The setup involves a running FusionAuth instance and three Node/Express applications, with specific ports assigned to each service. The article explains the distinction between authentication (user verification) and authorization (user access rights) and demonstrates how the gateway application centralizes user-level authentication checks, utilizing FusionAuth for secure route access. The Product Catalog service allows public access to product data, while the Product Inventory service restricts access to users with an "admin" role, illustrating granular authorization at the service level. The gateway application simplifies request routing and includes a basic UI for demonstrating OAuth login, with routes forwarding requests to the respective services based on user roles. The article concludes by suggesting further enhancements, such as adding more roles and building dynamic data tables for the microservices.

FusionAuth's version 1.19, released in early September, introduces several notable features and improvements while maintaining backward compatibility. Key highlights include revamped configuration options allowing settings through environment variables, Java system properties, or a properties file, with flexibility for Docker or Kubernetes users. New login page hinting allows users to bypass the FusionAuth login page and connect directly to third-party identity providers, enhancing the user experience. The release also supports importing refresh tokens from other systems to ensure seamless migrations, and introduces application-specific email templates for private label applications. With this update, session pinning is no longer required for the administrative interface and login pages, facilitating a stateless application architecture. Additionally, FusionAuth now supports true multi-tenant single-sign-on (SSO), enabling users to sign in to multiple applications across different tenants using the same browser. The release also includes various bug fixes and the resolution of GitHub issues.

The Disclosure conference is an annual, vendor-agnostic security conference that took place entirely online in 2020. The event featured two tracks: one for developers and another for security professionals. As a developer, I attended the developer track and found the content to be informative and engaging. The talks covered various topics such as strategic cyber warfare, OAuth security, anti-reconnaissance techniques, public key cryptography, and browser security. The conference provided opportunities for attendees to interact with speakers and other participants through live chat, Q&A sessions, and networking. While the virtual format had its limitations, I found that synchronous communication and person-to-person interaction made it feel more engaging than watching a series of pre-recorded videos. Overall, I enjoyed the experience and would attend again in the future, suggesting that others consider participating despite the challenges of an online format.

The tutorial provides an overview of customizing a theme for an advanced registration form using FusionAuth, a self-service authentication server. The process involves creating a new theme, modifying the messages file to add placeholders and labels, updating the theme in FusionAuth using the API, and previewing the changes. The tutorial also covers how to customize field display by modifying the `customField` macro and adding labels to each field. Additionally, it highlights the importance of reviewing themes in an incognito window for a better user experience.