November 2023 Summaries

Rob Aitken, CIO of the South Australian Tertiary Admissions Centre (SATAC), discussed how FusionAuth is being used to meet SATAC's authentication needs. SATAC is an admissions centre for higher education, aiming to aid and support students through a centralized admissions process. Rob's role as CIO involves aligning technology strategies with the organization's mission and broader business strategy. In the last 18 months, SATAC invested in its "Applicant Success" project, which targets customer experience and modernizing applicant processes. After adopting FusionAuth, SATAC saw significant improvements in user registration processes, resulting in a customer experience rating of 92%, exceeding expectations and measures of success. The organization uses FusionAuth for OAuth, user management, and social sign-on, with positive feedback on its performance. Rob chose FusionAuth over alternatives due to alignment with technical skills, time to deliver a solution, cost effectiveness, and the managed hosted version of the product, which provides assurance on security and currentness. Overall, SATAC is satisfied with FusionAuth's performance and appreciates the support team's willingness to help answer questions and provide expert advice.

The FusionAuth team is attending AWS re:Invent, a major technical conference in Las Vegas, to meet developers building on the AWS platform and exchange knowledge about authentication. The team will be present at various events, including talks and parties, and will have a booth where they can demonstrate biometric authentication and chat with attendees about their projects. They are also looking forward to learning from developers about what they're building on top of FusionAuth, Auth0, and Cognito, as well as discussing migration strategies for these solutions.

FusionAuth version 1.48 has shipped with several key updates, including improvements to webhooks, enhancements to user search capabilities, and the exposure of access tokens in lambdas. Webhook signing provides cryptographic certainty that payload contents are not tampered with during transit, while other improvements include better test messages and support for managing webhook certificates via the Key Master solution. Additionally, users can now paginate through all user and entity search results, retrieving tens of millions of records, and access tokens are made available in lambdas for use with Lambda HTTP Connect to request data from Identity Providers' Userinfo or other API endpoints. The release includes 34 issues, enhancements, and bug fixes, and users are advised to read the release notes carefully before upgrading their self-hosted instances.

There are many different ways to implement authentication, but the most common approach is to use a username and password. However, this method has been outdated for some time and can be complex to implement. A more modern approach is to use single sign-on (SSO) solutions, which allow users to log in to multiple applications using a single set of credentials. Authentication services can help save time and money by implementing and maintaining authentication systems, improve security by using best practices and the latest security technologies, reduce the risk of compliance violations by providing features such as two-factor authentication and user provisioning. When choosing an authentication service, factors to consider include features, pricing, ease of use, hosting options, and integration support. For developers who just want authentication to work without implementing it themselves, using an authentication service or a framework/library that provides authentication functionality can be a good option. Ultimately, the focus should shift from authentication to other aspects of building an application, such as picking software components like frameworks, databases, and hosting providers.

Fly.io is a platform for deploying and running containerized applications, offering features such as creating a Docker image, pushing it to the registry, and automatically launching the web application. It's gaining popularity among developers due to its fast, reliable, and secure nature. Fly.io provides competitive pricing, making it an attractive option for developers looking for a free or low-cost platform. To deploy FusionAuth on Fly.io, users need to create a Postgres database, set up a proxy connection to the local instance, and allocate an external IP address if needed. The application is then launched using the Dockerfile and redeployed as necessary. Users can scale the instance by running specific commands and access their application via the provided URL.

FusionAuth is a key component of larger applications, offering simple and secure authentication that can be integrated with various platforms, including JavaScript SPAs, mobile apps, and APIs through OpenID Connect, SAML, or HTTP APIs. The company has developed software development kits (SDKs) for JavaScript frameworks such as Angular, React, and Vue, which provide pre-built functionalities like login, logout, and user registration, enhancing ease of integration. SDKs differ from client libraries in that they offer abstracted functionality without needing an API key and are tailored for specific FusionAuth applications. FusionAuth emphasizes security and functionality by using browser redirects to handle sensitive user credentials, thus reducing the application's exposure to potential vulnerabilities. This approach allows applications to leverage FusionAuth's extensive authentication workflows, including features like MFA and social sign-on, while maintaining a customizable look and feel for hosted login pages. The use of server-side components ensures secure token storage and management, and while direct API interaction is possible, it is discouraged due to security considerations.

The FusionAuth team has been focused on building "authsome" identity solutions for developers over the past five years. They have built a successful business without raising outside money, focusing on customer needs and growth rather than growth-at-all-costs. This investment of $65 million from Updata Partners will help scale the company while maintaining its vision of providing easy-to-use authentication solutions that solve real-world problems. The market has evolved with advancements in passwordless login and new standards like OAuth 2.1, but most players have not kept pace, leaving a gap for FusionAuth to fill with its modern protection features and scalable infrastructure. With this investment, FusionAuth plans to expand its team, explore channel and technology partnerships, and continue innovating based on customer feedback.

FusionAuth has successfully completed a $65 million growth equity investment from Updata Partners, marking the first time the company has raised outside capital. This milestone comes as FusionAuth achieves widespread developer adoption and moves away from its bootstrapped past. Founded in 2018, FusionAuth has grown by over 100% year-over-year, serving over 450 customers across six continents, including well-known brands. The platform's free Community plan has been downloaded over 13 million times, providing developers with a seamless registration, login, and user management solution while adhering to industry standards. With the investment, FusionAuth aims to move even faster, leveraging expertise from Updata Partners' Principal Dan Moss and General Partner Jon Seeber to further accelerate its growth and market share.