January 2021 Summaries

The text discusses the concept of an "Auth Facade," a deployment architecture used by FusionAuth customers, which is beneficial for implementing software in diverse environments that are managed by clients and where traditional SaaS solutions are inadequate. It outlines the challenges of deploying applications in customer-controlled environments, especially those with data gravity or security concerns, and how the auth facade helps by providing a single interface for user data management and integration with existing identity providers like Azure Active Directory or Okta. This model allows developers to focus on application features rather than complex auth integrations, offering a deployable, flexible, and well-documented system that supports multiple environments and standards such as OIDC and SAML. The text emphasizes the importance of a robust data model, comprehensive documentation, and ease of deployment, highlighting FusionAuth as a suitable choice for implementing an auth facade due to its integration capabilities and supportive documentation.

Software engineering leaders often face the decision of whether to build an authentication system in-house or outsource it, with significant implications for speed to market, security, maintainability, and cost. Developing an in-house authentication system might initially seem advantageous for customization and control, but it carries risks like delayed product launches, increased vulnerability to security breaches, and higher maintenance burdens. Outsourcing, on the other hand, can expedite development, reduce liability in case of breaches or outages, and leverage the expertise of specialized providers, though it may involve ongoing costs and less control over features. Considerations such as the scalability of costs, the potential impact on company reputation, and whether authentication aligns with the company's core competencies are crucial in making this decision. Ultimately, leaders must weigh these factors to determine the most strategic approach for their organization.

David Wilson, CTO at Become Education, uses FusionAuth for OAuth and user management, leveraging its ease of use and scalability to support their "careers education as a service" platform. He chose FusionAuth over competitors due to its affordability, human pre-sales support, and serverless deployment model, which would simplify hosting and scaling costs. Wilson praises FusionAuth's flexibility in supporting various identity protocols and frameworks, making it an ideal solution for startups like his company. Despite some minor issues with syncing data between their system and FusionAuth, the platform has greatly accelerated product release timelines by allowing them to focus on features rather than user management.

FusionAuth version 1.23, released on January 11, 2021, introduces new features and resolves issues from previous versions. Notable additions include two new customer support roles: the read-only `user_support_viewer` for new employees to learn the admin UI without making changes, and the `user_support_manager`, which allows user management actions without privilege escalation capabilities. The update also integrates LinkedIn as a new identity provider, enabling users to register or log in using their LinkedIn accounts, which is beneficial for applications targeting professional audiences. Additionally, the release addresses ten bug fixes, including enhancements to the .NET Core client library, SAML signature validation, and IP address display for FusionAuth clusters. Users are encouraged to review the release notes for a comprehensive list of changes and to follow the upgrade guide for self-hosted instances, while FusionAuth Cloud users can request upgrades through their account dashboard.

The Grant Negotiation and Authorization Protocol (GNAP) is currently being formulated in an IETF working group. It will not be backward compatible with OAuth2, but aims to address similar problems, such as tight coupling of the auth process to redirects, archaic developer ergonomics, and limited deployment of sender-constrained tokens. GNAP includes features like multiple access tokens, interactions that are first-class concepts, continuation of a grant, built-in identity, and developer ergonomics. It is designed to make OAuth-style authentication easier to use and provides extension points for future communication. The protocol is still in the discussion and iteration stage, but its release is expected to begin in the middle of 2021. Users who are happy with OAuth2 should continue using it, while authorization server vendors and developers may want to take note of the GNAP spec and consider contributing or implementing it.

Justin Davis, Head of Engineering at Unsupervised, a machine learning platform, leverages FusionAuth's Enterprise plan to meet customer compliance requirements and manage authentication in disparate cloud environments. By choosing FusionAuth, Unsupervised can focus on their core engineering efforts while having a robust authentication system that abstracts away complexity from various client auth systems. This decision has saved the company an estimated additional senior engineer position, as well as automating setup of developer environments via Kickstart to ensure consistent configuration for every team member.