[{"data":1,"prerenderedAt":303},["ShallowReactive",2],{"project-17828293":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":41,"post_text":43,"what":44,"said":88,"maker_in_thread":184,"shape":194,"grid":198,"attempts":264,"same_week":265,"maker_shows":33,"maker_hidden":295,"reader_version":296,"card":297},"17828293","BuzzFeed SSO","BuzzFeed open source SSO","title","Show HN: BuzzFeed open source SSO","https:\u002F\u002Ftech.buzzfeed.com\u002Funleashing-the-a6a1a5da39d6","tech.buzzfeed.com","itwasntandy",1535039676,2018,166,36,231,2155,11,"notable","security_privacy","identity aware proxy","library",[24,25,21,26],"oauth2","sso","authentication","curious",0.079,{"positive":30,"neutral":31,"mixed":32,"critical":33},3,9,0,1,13,{"privacy":36,"docs":37,"idea":39,"execution":40},{"positive":32,"critical":33},{"positive":38,"critical":32},2,{"positive":32,"critical":32},{"positive":32,"critical":32},[32,30,30,33,32,42,32,42,32,30,32,30,32,30,32,32,30,32,32,32,32,30,32,42,30,30,32,32,32,32,32],5,null,{"problem":45,"audience":55,"pricing":43,"motivation":64,"time_to_build":43,"stack":74,"openness":85,"stage":86,"team_size":87},{"value":46,"source":47,"evidence":48},"Adds single sign-on authentication in front of internal services without changing them","maker",[49,52],{"id":50,"by":11,"text":51},"17828295","GitHub repo: https:\u002F\u002Fgithub.com\u002Fbuzzfeed\u002Fsso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind…",{"id":53,"by":11,"text":54},"17829859","Hey, there were a few reasons behind this. - ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this,…",{"value":56,"source":57,"evidence":58},"Organizations running many internal services, such as small organizations and BuzzFeed","inferred",[59,63],{"id":60,"by":61,"text":62},"17828874","Signez","Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little…",{"id":53,"by":11,"text":54},{"value":65,"source":47,"evidence":66},"Migrate 100+ oauth2_proxy instances and support remote employees and mixed AWS\u002FGCP infrastructure",[67,68,71],{"id":53,"by":11,"text":54},{"id":69,"by":11,"text":70},"17828903","Great question. We found that SAML doesn’t typically have great support on mobile devices [edit: had originally written browser here, hence the comments below], and since…",{"id":72,"by":11,"text":73},"17830837","It’s not. We acknowledge that in our blog post, and our approach was definitely influenced by the BeyondCorp philosophy. However google IAP requires that your infrastructure is…",[75,81],{"value":76,"source":47,"evidence":77},"Go",[78],{"id":79,"by":11,"text":80},"17832073","Golang is pretty beloved at BuzzFeed. It’s one of our two standard languages - the other being Python - and whilst the vast majority of our services are Python, Golang is being…",{"value":82,"source":47,"evidence":83},"OAuth2",[84],{"id":69,"by":11,"text":70},"open_source","launched","company",{"praise":89,"objections":103,"requests":122,"questions":136,"alternatives":158},[90,95],{"value":91,"source":92,"evidence":93},"Documentation and quick-start guides appreciated","commenter",[94],{"id":60,"by":61,"text":62},{"value":96,"source":92,"evidence":97},"Security review by outside firm and bug bounty",[98,99],{"id":60,"by":61,"text":62},{"id":100,"by":101,"text":102},"17828731","kingbirdy","This is mentioned in the article > In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon…",[104,111],{"value":105,"source":92,"evidence":106},"Security assessment lasted only one week",[107],{"id":108,"by":109,"text":110},"17829200","baby","It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.",{"value":112,"source":92,"evidence":113},"OAuth2 rationale over SAML was questioned",[114,118],{"id":115,"by":116,"text":117},"17828943","nancyp","IMO That's opposite of what I understand. The selling point of Oauth2 is SAML works great on web (mobile browsers included) but not so on apps.",{"id":119,"by":120,"text":121},"17828974","user5994461","That doesn't make sense. SAML is only a bunch of POST and redirections as far as the browser is concerned. There is no specific support required from the browser.",[123,130],{"value":124,"source":92,"evidence":125},"Support for additional OAuth2 providers beyond Google",[126],{"id":127,"by":128,"text":129},"17829878","markovbot","Looks super interesting. I'm looking to do something like this for my personal stuff, but I'd rather avoid the dependency on Google. Does anyone have suggestions for how to set…",{"value":131,"source":47,"evidence":132},"Better documentation",[133],{"id":134,"by":11,"text":135},"17829888","thank you - We know from our own experience using other open source projects that having documentation, and guides to get started really helps. We know there is more to do there…",[137,144,151],{"value":138,"source":92,"evidence":139},"Pen-testing by an independent company?",[140],{"id":141,"by":142,"text":143},"17828675","andremat","Have you contracted an independent pen-testing company to assess your design and implementation?",{"value":145,"source":92,"evidence":146},"Why not Keycloak?",[147],{"id":148,"by":149,"text":150},"17829363","snuxoll","Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?",{"value":152,"source":92,"evidence":153},"Works with Nginx auth_request?",[154],{"id":155,"by":156,"text":157},"17831917","ashayh","Is it possible to use this with Nginx auth_request? I use bitlys oauth2_proxy like so because it doesn't support websockets.",[159,163,170,177],{"value":160,"source":92,"evidence":161},"Keycloak",[162],{"id":148,"by":149,"text":150},{"value":164,"source":92,"evidence":165},"Google Cloud IAP",[166],{"id":167,"by":168,"text":169},"17830736","rllin","a bit ignorant in this area, but how is this functionally different than Google Cloud IAP?",{"value":171,"source":92,"evidence":172},"traefik-forward-auth",[173],{"id":174,"by":175,"text":176},"17830415","thomseddon","We took a slightly different approach to solving a similar problem: https:\u002F\u002Fgithub.com\u002Fthomseddon\u002Ftraefik-forward-auth We were already using traefik as a proxy for our…",{"value":178,"source":92,"evidence":179},"bitly oauth2_proxy",[180],{"id":181,"by":182,"text":183},"17840586","wrboyce","I have used https:\u002F\u002Fgithub.com\u002Fbitly\u002Foauth2_proxy with success, and it supports a variety of providers.",{"comments":18,"answered":185,"key":186},7,[187,188,191],{"id":50,"text":51},{"id":189,"text":190},"17829399","That is understood, and is always why we engaged with some of the top researchers who contribute to our bug bounty program, from the start with this project. For example offering…",{"id":192,"text":193},"17828776","Yes, as mentioned in the blog post, we worked with Security Innovation to do a week long security assessment with full access to source code, design documents and endpoints. We…",{"commenters":195,"max_depth":196,"maker_replies":18,"first_comment_mins":32,"lifespan_hours":197},19,6,45,[199,201,203,204,206,207,211,212,214,216,218,219,221,223,227,228,230,233,234,236,238,239,240,242,245,246,248,249,253,257,260],[50,32,32,200,11,33],"project\u002Fneutral\u002Fnone",[141,32,30,202,142,32],"maker\u002Fneutral\u002Fprivacy",[100,32,30,202,101,32],[108,32,33,205,109,32],"maker\u002Fcritical\u002Fprivacy",[189,32,32,202,11,33],[208,32,42,209,210,32],"17829674","maker\u002Fpositive\u002Fdocs","yubozhao",[192,32,32,202,11,33],[60,32,42,213,61,32],"project\u002Fpositive\u002Fdocs",[134,32,32,215,11,33],"maker\u002Fneutral\u002Fdocs",[148,32,30,217,149,32],"maker\u002Fneutral\u002Fidea",[53,32,32,217,11,33],[155,32,30,220,156,32],"maker\u002Fneutral\u002Fexecution",[222,32,32,220,11,33],"17832170",[224,32,30,225,226,32],"17831336","maker\u002Fneutral\u002Fnone","Dowwie",[79,32,32,225,11,33],[174,33,32,229,175,32],"other\u002Fneutral\u002Fidea",[231,38,30,232,116,32],"17828862","project\u002Fneutral\u002Fidea",[69,38,32,217,11,33],[115,38,32,235,116,32],"commenter\u002Fcritical\u002Fidea",[237,38,32,217,11,33],"17829001",[119,38,32,235,120,32],[127,30,30,232,128,32],[241,30,32,232,11,33],"17829941",[243,30,42,244,128,32],"17830134","maker\u002Fpositive\u002Fnone",[181,30,30,232,182,32],[167,247,30,232,168,32],4,[72,247,32,232,11,33],[250,42,32,251,252,32],"17829532","other\u002Fpositive\u002Fnone","supuun",[254,42,32,255,256,32],"17829705","other\u002Fneutral\u002Fnone","minimaxir",[258,42,32,251,259,32],"17831685","solarkraft",[261,42,32,262,263,32],"17833238","other\u002Fcritical\u002Fnone","philliphaydon",[],[266,271,276,280,285,290],{"id":267,"name":268,"points":269,"category":270},"17871313","wolfram-cellular-automata",1072,"learning_science",{"id":272,"name":273,"points":274,"category":275},"17827797","Windows 95",213,"creative",{"id":277,"name":278,"points":279,"category":20},"17846491","How privacy-friendly is your site?",200,{"id":281,"name":282,"points":283,"category":284},"17834274","JobEnabler",177,"productivity",{"id":286,"name":287,"points":288,"category":289},"17845565","Ledger-analytics",102,"finance_crypto",{"id":291,"name":292,"points":293,"category":294},"17848846","Quetree",91,"web_saas",false,"v2",{"id":298,"name":5,"line":6,"ai":295,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":299,"top":18,"kw":300,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":301,"url":9,"mix":302,"praise":91,"objection":105,"sub":21},17828293,0.08,[24,25,21,26],"0331050503030300300003053300000",[30,31,32,33],1794036568938]