October 2024 Summaries

The Microsoft Entra ID app gallery is a collection of thousands of pre-integrated applications with the Microsoft Identity stack, acting as both a marketplace and distribution channel. It simplifies certain scenarios such as deploying multiple pre-configured applications behind a central Microsoft Entra sign-in experience. The personas who use and benefit from the gallery include enterprise IT and security teams, software vendors, and independent developers. The supported auth protocols are SAML 2.0, OpenID Connect, password-based Single Sign-on (SSO), and Linked Authentication. The Entra app gallery is valuable for organizations with strong requirements around centralized identity management and automated provisioning but may not be suitable for smaller organizations or those requiring specialized compliance controls.

Implementing SAML (Secure Assertion Markup Language) in an application can be challenging due to the need for specialized knowledge and potential security threats. WorkOS offers a simpler solution with its SSO API, which handles identity and access management, reducing engineering time and ensuring compliance with regulations like HIPAA and GDPR. To implement SAML using WorkOS, users must sign up for an account, obtain an API key and Client ID, configure the SAML connection, add an endpoint to initiate SSO, and retrieve user profiles. With this approach, developers can easily extend support to other enterprise features like SCIM and JIT provisioning.

System for Cross-domain Identity Management (SCIM) is a protocol that automates the process of adding users to various applications within an organization. This tutorial provides a comprehensive guide on how SCIM works, using real-world examples and API calls and responses. The full SCIM lifecycle includes authentication, provisioning, modifying, synchronization, deprovisioning, handling errors, rate limits, and service provider configurations. Implementing SCIM in an application requires building complex provisioning logic, user synchronization, and enterprise-grade security features. WorkOS offers a ready-to-use SCIM implementation that can be integrated into applications to make them Enterprise Ready quickly.

Fine-Grained Authorization (FGA) is a more granular and scalable authorization scheme than traditional Role-Based Access Control (RBAC). Unlike RBAC, which defines permissions at the app section level, FGA allows for precise control over individual resources. This makes it ideal for apps with user-generated content that require handling millions of authorization requests per second. Implementing FGA can be complex and requires a data model that efficiently represents relationships between users and resources. It also involves building resolver logic to handle cases where permissions aren't explicitly coded into an authorization check but are implied by other existing roles or hierarchies. Centralized vs. decentralized FGA architectures depend on the existing architecture of a company, with centralized implementations being more common for FGA systems. Several open and closed source options have emerged to help teams outsource FGA implementation, such as WorkOS FGA, SpiceDB, and OpenFGA.

On September 10th, 2024, a critical security flaw (CVE-2024-45409) was disclosed in Ruby-SAML and OmniAuth-SAML libraries, allowing complete authentication bypass. This vulnerability has the highest possible score of 10 on GitHub's CVE rubric and a 9.8 NIST base score. The flaw enables an attacker to log in as any user, including administrators. It remained undiscovered for over a decade in a popular open-source library used for authentication. GitLab has released patches for its community and enterprise editions, but users must update their systems immediately to mitigate the vulnerability. This incident highlights the challenges of maintaining open-source projects and the need for regular security audits and trusted security experts like WorkOS.

X.509 certificates are digital documents that use a digital signature to bind a public key with an identity, ensuring the authenticity of the server and encrypting information being exchanged. They play a crucial role in secure communications and are widely used across websites, VPNs, Wi-Fi networks, and IoT devices. Generating X.509 certificates typically involves creating a key pair (private and public keys) and then creating a Certificate Signing Request (CSR), which is submitted to a certificate authority (CA) for signing. WorkOS offers an easy way to manage certificates through its Admin Portal, allowing automatic updates of expiring X.509 certificates.

This technical guide explains how to migrate from Role-Based Access Control (RBAC) to Fine-Grained Authorization (FGA) using WorkOS. It covers checking a user's access to resources, managing FGA implementation, and balancing performance versus consistency on a per-request basis. The guide also discusses warrant tokens and how they can be used for favoring performance or consistency based on application requirements. Additionally, it explains the use of the dashboard for event logs.

In the transition from Role-Based Access Control (RBAC) to Fine-Grained Authorization (FGA) using WorkOS, the focus shifts from assigning broad roles to tailoring access based on multiple factors like role, seniority, location, and time, thus enhancing security. FGA allows for more detailed access rules, determining not just whether a user can access a resource but which specific data they can view or edit. The process involves defining resource types, relationships, and inheritance rules to create a robust authorization model. WorkOS facilitates the implementation of this model through a schema language and API, enabling consistent enforcement across various applications and microservices. Testing and validating the access model is crucial, and this is achieved through test assertions and automated scripts. The guide outlines the steps to design and test the FGA model, highlighting its advantages over traditional RBAC by addressing its limitations like role explosion and lack of flexibility, and sets the stage for integrating these advanced access controls into applications.

Enterprise Single Sign-On (SSO) is an authentication service that allows employees to sign in once into a corporate Identity Provider (IdP) and access multiple applications and systems across the organization. It simplifies access without compromising security, centralizes user management, and makes it easier for organizations to enforce strong security policies. SSO works by establishing trust relationships between IdPs and Service Providers (SPs), using protocols such as Security Assertion Markup Language (SAML), OpenID Connect (OIDC), Lightweight Directory Access Protocol (LDAP), and Kerberos. The benefits of SSO include convenience, increased security, improved compliance, and better user experience. Supporting SSO in your SaaS app can help close more deals with enterprises, improve user adoption and retention, reduce security burden, and enhance overall security.

OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0 that allows users to authenticate once and gain access to multiple apps without re-authenticating. It's commonly used for Single Sign-On (SSO), which helps websites and applications verify the identity of users without needing to manage and store sensitive details like passwords. The main advantages of OpenID Connect are standardization, ease of implementation, security, and broad support across different types of clients and identity providers. OIDC works by extending OAuth 2.0 with an ID token that contains user authentication information. It supports various flows for different types of apps, such as Authorization Code flow, PKCE flow, Implicit flow, and Hybrid flow. Best practices include using secure connections, validating ID tokens, handling redirect URIs securely, and implementing appropriate OAuth scopes.

In September, WorkOS announced updates including an Enterprise Ready Conference in San Francisco for product and engineering leaders building enterprise SaaS, with topics covering advanced identity management, compliance, encryption, logging, and FGA. Additionally, they highlighted their HIPAA compliance status, which meets strict standards for handling electronic protected health information (ePHI) in the U.S. WorkOS also introduced session management for frontend apps using React or JavaScript SDKs to ensure secure user sessions by default. Furthermore, AuthKit branding customization now supports enhanced options for sign-in and sign-up pages with custom HTML/CSS. The Python SDK v5 features SDK-wide type hints, asyncio support, simplified auto pagination, multiple client instances, and FGA APIs. Finally, a new Ruby AuthKit example app demonstrates how to integrate AuthKit in Ruby with full session management, built using Sinatra web server.