May 2021 Summaries

Trevor Robinson, co-founder and CTO of FITT Finder, discusses how his startup, a search engine for health and fitness activities, utilizes FusionAuth for user authentication. FusionAuth was chosen to replace custom user management due to its scalability, security, and cost-effectiveness, especially important for a bootstrapped startup aiming to scale to millions of users. FITT Finder leverages FusionAuth's OAuth, login, and registration APIs to manage user credentials and authentication, with plans to incorporate social sign-on and SAML SSO. Despite minor concerns regarding zero-downtime upgrades and memory demands, Robinson appreciates FusionAuth's core functionality, API, and community support, running the service on AWS ECS with MySQL as the database. The integration of FusionAuth saves significant development time and ensures adherence to evolving security best practices, allowing FITT Finder to focus on maintaining up-to-date activity data through periodic jobs and third-party APIs.

This is the latest version of FusionAuth, released on May 5, 2021, with several enhancements and bug fixes. Account email verification gating has been added, which requires a paid license to block users from completing their login until they verify their email address. Application themes have also been improved, allowing tenants to create separate themes for hosted login pages. Additionally, safe links in passwordless emails have been addressed, fixing an issue with network security devices and email clients interfering with the authentication process. The release includes many other enhancements, such as transparent unique username generation, API updates, and more. Users are advised to read the release notes carefully before upgrading their self-hosted or cloud-based FusionAuth instances.

To prioritize security, quality development practices, and robust governance controls is crucial for software engineering leaders given the increasing number of data beaches. The authentication system is a critical area that requires careful attention to ensure customer trust and minimize risks. Building an authentication system from scratch can introduce errors, while using third-party services can reduce risk and speed up development. It's essential to bake security controls into the software development process through automated code linting, static code analysis, periodic penetration testing, code review, coding standards, security training, senior developer coaching, and pair programming. Implementing these measures can significantly impact the overall security of the system.

Jason Musyj, Co-Founder and CTO of Unio, a business messaging and collaboration tool, leverages FusionAuth for user management, authentication, authorization, APIs, and secure token signing. This standardized solution has saved Unio around 1000 developer hours and $100k in savings compared to rolling out their own authentication services. FusionAuth's robust feature set, flexible deployment capabilities, and cost have made it an attractive choice over competing products. With FusionAuth, Unio can self-host, configure, and extend the platform as desired, integrating easily with SDKs and APIs. The solution has also helped improve security and privacy for their platform.

FusionAuth has launched Entity Management, a versatile new tool designed to help developers manage and model permissions not only for users but also for servers and systems, providing a flexible solution that is not restricted to specific use cases. This product addresses the challenge of managing fine-grained permissions across various entities such as users, contractors, IoT devices, and machine-to-machine environments. By enabling developers to offload the time-consuming task of creating and editing permissions, Entity Management allows them to concentrate on their primary responsibilities. It can be applied to a range of scenarios, including B2B organizations, IoT deployments, and machine-to-machine communications, offering nuanced permission control. FusionAuth emphasizes its API-first identity and access management platform, which can be integrated quickly and aids developers in meeting compliance requirements efficiently.

The FusionAuth community forum is an active platform where users discuss various topics related to FusionAuth, including how to solve problems and integrate authentication systems with other software packages. Recent posts highlight the features of email verification in the community version, which automatically sends a verification email to new users, as well as modifications to the JWT header, which requires custom implementation due to limitations in the built-in functionality. Another post discusses an issue where user registrations kept disappearing mysteriously and was resolved by disabling the self-service registration feature that removed unverified users after a certain period. The community forum is open to participation for free or anonymous browsing of current discussion topics.

FusionAuth is a company that aims to improve the mental and physical health of developers by addressing the pain points associated with repetitive coding tasks, particularly in the customer identity access management (CIAM) space. Many workstations now come equipped with furniture and devices designed to promote natural posture, reduce exertion, and optimize reach zones, boosting productivity for employees. The company recognizes that the mental strain caused by complex coding can be just as debilitating as physical strain, making it a key area of focus in their efforts to support developers' overall well-being.

The latest version of FusionAuth has been released, addressing issues with earlier versions and introducing several enhancements. Advanced multi-factor authentication (MFA) is now available as a premium feature, allowing users to customize their MFA experience, including adding new factors such as email. Entity Management is also a new premium feature that enables modeling entities beyond users, making it easier to manage machine-to-machine communication in dynamic service-oriented applications. Additionally, an API to manage API keys has been introduced, enabling the automation of every aspect of FusionAuth. Other notable enhancements include support for FusionAuth acting as an SP for IdP-initiated SAMLv2 SSO, user profile self-service, a Prometheus endpoint for monitoring, and improved licensing options in air-gapped deployments. The release also includes various bug fixes and improvements to the admin UI experience. With this new version, users can now upgrade their self-hosted instances or proceed with upgrading their FusionAuth Cloud deployment, depending on their needs.