March 2021 Summaries

FusionAuth is a multi-tenant authentication service used by John Maia and his team at Seegno, which handles over five thousand tenants in their largest environment. They use FusionAuth to manage users, session tokens, social sign-on, and offer features such as passwordless login and email services. The solution has saved them significant time and money compared to maintaining their own authentication solution. John and his team have found FusionAuth to be the most versatile, easy to use, and configurable solution, with a quick response from the support team when they encounter issues, allowing them to find solutions together. However, they do struggle with running multiple instances of FusionAuth in Kubernetes, requiring workarounds such as creating separate deployments and services to achieve this functionality.

Evaluating authentication providers requires a strategic approach to ensure the right choice is made for a software product, emphasizing the importance of an effective trial period. Key steps include identifying priority questions and use cases to address during the trial, setting a realistic timeline that may involve negotiating an extended trial period, and isolating experiments in a non-production environment to avoid unintended consequences on live data. This method allows for a thorough assessment of the provider's capabilities across different platforms, such as web and mobile, ensuring the product team can make a well-informed decision without unnecessary time and financial investments.

Migrating user data can be a challenging task due to its potential impact on human users. There are three main approaches to migrating user accounts: the big bang migration, where all users are migrated at once; segment by segment migration, where smaller chunks of users are migrated one at a time; and slow migration, where each user is migrated individually as they log in. Each approach has its strengths and weaknesses, including factors such as risk, timeline, implementation complexity, and potential impact on user experience. The big bang migration offers simplicity and speed but also carries higher risks due to the large number of users affected. Segment by segment migration decreases cutover risk but introduces additional complexities and planning requirements. Slow migration limits the blast radius in case of issues during the migration, allows for more control over password management, and simplifies application cutover. However, it requires running both systems for a longer period and may involve additional technical considerations. Ultimately, the choice of approach depends on factors such as the size of the user base, the complexity of the system, and the desired level of risk tolerance.

Auth0 was recently acquired by Okta, prompting consideration of migration options for developers. When evaluating a new authentication system, it's essential to consider the vendor's trustworthiness and operational complexity. A broad evaluation should include factors such as self-hosted or SaaS models, open-source status, standards support, core functionality, single sign-on capabilities, integrations with other auth technologies, cost, and documentation quality. Feature matrices can help determine requirements and "nice to haves" for each solution. Prototyping is crucial before deciding on a new provider, as it allows testing of the riskiest integration and evaluation of non-standard functionality such as Universal Login. A detailed analysis of Auth0's functionality and its differences from other providers like FusionAuth should be performed, including user data migration, connections, rules, hooks, actions, APIs, applications, SSO integrations, tenants, roles, and permissions. Ultimately, the goal is to find a solution that meets the organization's needs while minimizing operational complexity and ensuring a smooth migration.

This interview highlights Lohith Venkatesh, a software developer at DolphinVC, who shares his experience with FusionAuth, an authentication service. He explains that he chose FusionAuth for its flexibility in deploying the service on his own private data center, which was important for price and deployment reasons. Lohith's team uses FusionAuth for user management, social sign-on, and authentication logic, solving several problems they faced previously, such as constraining themselves to a specific cloud provider. He has built custom features like phone one-time password authentication and email auth flows on top of the FusionAuth API. Lohith praises FusionAuth for its documentation, APIs, and price, stating that it has saved his team at least a month or more of time and money. He also shares that running FusionAuth on a Kubernetes cluster is an efficient way to deploy the service. The interview concludes with feedback from Lohith, including the desire for a complete implementation of a multi-tenant role in the admin UI.

In this article, we'll walk through the step-by-step process of implementing the OAuth Authorization Code Grant in a Vue.js app using FusionAuth as the Identity Provider (IdP). We'll cover the key points of setting up FusionAuth, configuring the Vue.js app, and creating routes for authentication, authorization, and user data management.

FusionAuth has released version 1.25, which resolves issues for community members and customers on versions 1.24 and older, containing numerous enhancements and bug fixes. The new release adds debugging capabilities, allowing users to solve integration issues with additional logging, and introduces features such as full support for the SAMLv2 Logout spec, the ability to delete all user sessions in one go, and improvements to the Twitter Identity Provider. Additionally, bugs were fixed, including a regression issue with Elasticsearch 6, null pointer exceptions when generating login reports, and erroneous validation errors with the Application object. The release also includes upgrade guides for self-hosted and cloud deployments.

Modern authentication systems face a complex challenge in balancing security and scalability due to the computational intensity of hashing passwords with expensive algorithms. Ensuring secure authentication requires managing the work factor, or the number of hashing iterations, to withstand potential attacks while avoiding performance degradation. As computing power increases, systems must be updated to maintain secure hashing standards, as recommended by OWASP. Additionally, distributed systems can become inefficiently "chatty" when numerous services redundantly verify authentication, leading to increased latency and hardware costs. Compliance with standards like SOC 2 often necessitates additional security features such as two-factor authentication, which can further impact scalability by increasing network demand. Lastly, authentication systems must ensure high availability to prevent application downtime, which involves investing in more robust infrastructure.

Auth0 has been acquired by Okta, a major validation of the importance of Customer Identity and Access Management (CIAM) in applications. Auth0 was instrumental in popularizing CIAM through its user-friendly integrations with various login systems and open-source documentation. The acquisition highlights the growing need for secure identity solutions in applications. As a result, FusionAuth believes that its focus on flexibility, affordability, and developer-centric features will remain distinct from Okta's strategy, providing developers with an alternative to Auth0's model.

Dr. Laurent Michel, a FusionAuth community member and product owner at Softozor, discusses how his small team is utilizing FusionAuth to address their authentication needs within their e-commerce platform designed to support craftsmen, such as farmers and bakers, in selling their products regionally. Softozor, composed of physicists, mathematicians, and teachers, is primarily focused on developing educational video games but depends on software development projects for funding. They have integrated FusionAuth into their platform's admin panel for user management, generating JWTs consumed by their Hasura API, which is vital for permission management and secure operations. The decision to use FusionAuth over other options was influenced by its ease of installation, comprehensive features, and outstanding documentation, saving them significant time and resources. The platform is progressing gradually, leveraging a Kubernetes cluster and adhering to the JAMstack philosophy, with plans to extend FusionAuth integration beyond the admin panel. Michel notes their satisfaction with the .NET and Python SDKs and suggests potential improvements such as supporting Pasetos for enhanced security.