February 2021 Summaries

In today's software development ecosystem, third-party vendors like Authentication-as-a-Service (AaaS) are becoming increasingly common, offering out-of-the-box capabilities to engineering teams. However, outsourcing authentication capability can introduce significant risks if due diligence isn't observed, as seen in the 2017 Equifax data breach. Performing due diligence involves a series of steps that requires research and testing the capabilities of a third-party vendor, including security standards, encryption policy, response to Common Vulnerabilities and Exposures (CVEs), ownership of responsibility in case of a cyber attack, and compliance with industry regulations such as HIPAA and GDPR. Additionally, other aspects to consider include performance, engineering implementation effort, and pricing, which can be explored further in the article "Performing Due Diligence on Authentication Vendors".

JSON Web Tokens (JWTs) are used to securely share claims or attributes between clients and servers in microservices. This guide illustrates how to implement JWTs in a Golang microservices environment using the open-source jwt-go package. The process involves generating a JWT token with a signing key, using an endpoint to serve the token, and creating a microservice server with middleware for authorization. The middleware validates the JWT to ensure authorized access to microservices, demonstrating the use of JWTs for secure service-to-service communication. The tutorial also covers setting up an API gateway to validate JWTs and protect internal services, with code examples provided to create a protected microservice endpoint. The code is available on GitHub, and further exploration includes using tools like FusionAuth for JWT generation, securing applications with OAuth, and using more advanced signing algorithms.

Maciej Wisniowski, a full-stack web developer at Orbitvu, is using FusionAuth as an OAuth2/OIDC/SAML server to provide login and SSO to various applications. He leverages FusionAuth's API for internal integration with other systems like ERP and project management software. The benefits of having one view of customer accounts across multiple applications include seamless switching between apps without logging in, centralized user account management, and secure integration with external providers. FusionAuth offers flexibility, competitive pricing, and customization options, making it a cost-effective solution compared to competitors. Maciej appreciates the product's development style, GitHub issue tracker, and support community, which feel like an open-source project despite not being open source itself.

We are excited to announce the release of version 1.24 of FusionAuth, a bug fix and small enhancement release that addresses issues for users on versions 1.23 and older. This release includes several enhancements such as more consistent caching, support for certain SAML integrations, improvements to the webhooks screen, and removal of unnecessary claims from the `id_token`. Additionally, bugs were fixed, including Kafka configuration parsing issues, imports of unsupported certificates, and a UX regression that prevented removing users from groups. To upgrade your self-hosted instance, check out our upgrade guide, or have us handle the upgrade for you if you're on FusionAuth Cloud.

The text provides a detailed tutorial on setting up a Single Sign-On (SSO) system using FusionAuth, exemplified through two fictional applications, Pied Piper and Hooli. The SSO allows users to log in once and access multiple applications without re-authenticating. The tutorial guides the reader through configuring FusionAuth, setting up domain names, and writing the necessary server and client-side code using Node.js and Express, including handling user sessions and implementing logout processes. Emphasis is placed on the ease of switching between applications once logged in, highlighting the convenience of SSO. The tutorial also addresses potential browser-specific issues with SSO logout and suggests further enhancements, such as adding roles and creating additional applications. The complete example is available on GitHub for further exploration and modification.

You lead a team of engineers, and your team is responsible for building out a new customer-facing product that could have a huge impact on the trajectory of your company. Lately you've been considering whether or not rolling your own authentication system is a good idea, and after careful consideration, you've concluded that it's not in the best interests of your company. To talk to all the relevant stakeholders about this choice, you need to adapt your approach based on the size and structure of your company. You'll have to emphasize the benefits of outsourcing your auth system to each type of stakeholder, including your boss, developers, project management, product management, legal, quality assurance, UX and design, security, and infrastructure teams. By doing so, you can build a consensus among stakeholders that will help you achieve the best outcome for your company. Key points include reducing implementation time and costs, mitigating risk, allowing team members to focus on more interesting features, and ensuring compliance with data protection laws and standards certifications. Ultimately, the goal is to emphasize spending time doing new things and building new features that solve problems for customers, rather than reinventing existing functionality.