Auth0 Blog

If you need to implement your own OIDC/OAuth I highly recommend Identity Server 4[1]. I've used it in production and it was fairly painless to get up going. It's .NET based & battle-tested. It has lots of samples on GitHub to show you how to get going for the various flows (which they even walk you through in their docs) and has a quickstart UI so you've got something you can brand quickly to give users a contiguous login experience. However, if you can manage not to host your own (don't want to mess with it), I recommend either Auth0[2] or the one of the AWS/Azure solutions mentioned elsewhere. [1]https://github.com/IdentityServer/IdentityServer4 [2]https://auth0.com/

My favorite identity provider of all time is https://auth0.com I was very impressed by their rules concept [1] that allowed me to create quite non-trivial authentication scheme in one day from scratch [2] They also pay attention to development workflows by having great logs and debugging tool chain as a part of their service, very cool! [1] https://auth0.com/docs/rules [2] https://gravitational.com/blog/aws-github-sso/

Auth0 http://www.auth0.com Bellevue, WA Inside Sales Executive (SEATTLE, WA, REMOTE) We are experiencing tremendous growth. You will be central to accelerating it even further by engaging with our customers, listening to their challenges and delighting them by creating sales proposals that match their needs. What will be your responsibilities: -Qualify inbound opportunities and prospect for new ones. -Create win-win sales proposals matching our subscribers' use cases. -Close business. -Keep track of all the steps through CRM and other systems. What we need from you: -Excellent listening skills and engaging personality. -Strong negotiation skills with win-win mindset. -Impeccable track record of quota attainment. -Diligent and very organized in keeping sales opportunities in CRM and other tools.

Auth0 https://auth0.com - Remote | Seattle, USA | Buenos Aires, AR Auth0 makes identity simple for developers. Our subscriber base consists of more than 24,000 developers at over 20,000 enterprises across more than 150 countries around the world. We are growing quickly and well funded. https://auth0.com/blog/2015/06/23/another-big-milestone/ We are looking to expand our team in the following roles: * Engineer (backend, frontend, ops) * Product Designer * Technical Writer * Customer Success Engineer See more at https://auth0.com/jobs p.s. We also offer paid internships in Buenos Aires (flight, airbnb and salary)

https://auth0.com/ provides some pretty incredible documentation (they also provide a great product; we use it to support authentication for our suite of corporate/enterprise-facing apps)

Auth0 (https://auth0.com/) | Seattle - Buenos Aires - London - Sydney - Tokyo - Remote | Full-time | Engineering Awesome tech is made by awesome people. And we’re always looking for new team members who bring the energy, passion, commitment, and collaboration that has made Auth0 the great company it is today. So what do we exactly build? Auth0 is an authentication and authorization platform designed by developers, for developers. Basically, we make companies’ login boxes safe, secure, and seamless for anyone logging in. Our mission is to secure the world’s identities so innovators can innovate. But it’s a big mission that requires a lot of teamwork. Words, code, or people, whatever your skill, there’s a place for you here. Auth0 makes the internet safer by safeguarding billions of login transactions each month. Our team is spread across more than 35 countries and we are proud to continually be recognized as a great place to work. Culture is critical to us, and we are transparent about our vision and principles. We practice N+1>N which applies to everything from our people to how we iterate our tech; we believe in one team, one score; and we give a shit about everything we do. Open jobs: Senior Data Security Engineer: https://www.okta.com/company/careers/engineering/senior-data-security-…

Auth0 (https://auth0.com/) | Seattle - Buenos Aires - London - Sydney - Tokyo - Remote | Full-time | Engineering Awesome tech is made by awesome people. And we’re always looking for new team members who bring the energy, passion, commitment, and collaboration that has made Auth0 the great company it is today. So what do we exactly build? Auth0 is an authentication and authorization platform designed by developers, for developers. Basically, we make companies’ login boxes safe, secure, and seamless for anyone logging in. Our mission is to secure the world’s identities so innovators can innovate. But it’s a big mission that requires a lot of teamwork. Words, code, or people, whatever your skill, there’s a place for you here. Auth0 makes the internet safer by safeguarding billions of login transactions each month. Our team is spread across more than 35 countries and we are proud to continually be recognized as a great place to work. Culture is critical to us, and we are transparent about our vision and principles. We practice N+1>N which applies to everything from our people to how we iterate our tech; we believe in one team, one score; and we give a shit about everything we do. Open jobs: Senior Engineer, IAM User Management: https://jobs.lever.co/auth0/7ca518b8-c20a-4fcd-ae62-e6dbcce422b5 Senior Software Engineer, IAM Login: https://jobs.lever.co/auth0/ee38f05f-b87f-4411-8e9c-cc0bc36d5652 Product Manager, Developer Experience:…

There are a number of services that offer user management: https://aws.amazon.com/cognito/ https://auth0.com/ You just need to provide a hook on the app/website to authenticate. Not sure if you can completely get away from doing any kind of database. I bet you'll need to store some kind of user state. Again, try amazon dynamodb, or their Postgresql alternative, all cloud hosted with backups. Now some comments: - Founders demanding "unhackable" implementation. Be clear, explain you'll do your best to ensure that is the case, but even large companies with 1,000s of developers and security professionals are still getting hacked. Explain there is no way you can provide a guarantee (so that later it does not become reason for dismissal or something like that). And whoever will guarantee unhackable solution is simply lying. - If I understand correctly, there are 2 founders (idea people), and you are the first programmer. If that is the case, you are the sole person responsible for implementation, design, support, hardware, deployment, networking.. and other stuff. And you got 6% of equity... I would question that. Good luck

Auth0 | REMOTE | Full Time | https://auth0.com Auth0 is looking for Infrastructure Engineers to help ensure that our services stay up and running while continuing to rapidly ship software that our customers love. An Infrastructure Engineer is a specialist in creating, deploying and running infrastructure and have a great knowledge of networking, the linux kernel and systems scaling. We are looking for people that have a passion for building robust infrastructure components that others can reuse and have a track record of working with infrastructure at world scale. Responsibilities - Manage our infrastructure and provide alerting for teams to detect common problems - Collaborate with development teams to introduce and test updated infrastructure components to be delivered as a service on AWS, using tools and technologies like TerraForm, MongoDB, ElasticSearch, and more - Design and develop the backup and restore procedures for storage services - Respond to on-call pages caused by failures related to the infrastructure services they own Requirements - In-depth knowledge of Linux internals - Understanding of config management and immutable infrastructure (SaltStack experience preferred) - Significant scripting expertise (e.g., with Python, Node.js, Shell Script, etc.) - Excellent communication and collaboration skills - Preferred, not a hard requirement: working at (or with significant overlap with) Pacific Time About our hiring process:…

There are multiple ways, you can use known authorization methods like RBAC, or if you want something more fancy ReBac (tools like openfga, https://openfga.dev). But there's only so much that you can do with that, if you need to call third party APIs on the user's behalf I'd recommend going with a solution revolving around custom token exchange (https://datatracker.ietf.org/doc/html/rfc8693). You can check something like Auth0 offers: https://auth0.com/ai Which would cover things like token exchange for third party APIs, human in the loop, and also authorization methods.

Auth0 is an option not just for the enterprise. I'm developer advocate there, you get 25,000 users in our free tier with a custom domain, unlimited social connections, basic attack protection, and more.(https://auth0.com/pricing). We also have the Auth0 for Startups program you can apply to and get one year free. (https://auth0.com/startups) Reach out with any questions. Would love to help you with your project

Maybe it's worthwhile pointing out that even Auth0 is kind of exploring a bespoke way of doing this: https://auth0.com/docs/customize/extensions/authorization-extension/us…

It's no accident. If you read any early historical accounts[0] of Mocha -> LiveScript -> JavaScript, you can see why. From the linked: > What was meant to be a Scheme for the browser turned into something very different. The pressure to close the deal with Sun and make Mocha a scripting companion to Java forced Eich's hand. A Java-like syntax was required, and familiar semantics for many common idioms was also adopted. So Mocha was not like Scheme at all. It looked like a dynamic Java, but underneath it was a very different beast: a premature lovechild of Scheme and Self, with Java looks. [0] https://auth0.com/blog/a-brief-history-of-javascript/

I recommend using an existing implementation rather than reinventing it. https://supabase.com/docs/guides/auth/auth-email or https://auth0.com/docs/authenticate/passwordless/authentication-method…

I haven't used it in a while, but it sounds like Auth0 [https://auth0.com/] is what you're looking for.

> Unfortunately I think it's a little low-level for most implementers, who just want to know which library to use and are scared of things like cofactors and prime-order groups. Ah, yeah, totally fair. I have other blog posts that tackle high-level things. ;) > Also: it's 2022 and has an ECC side-channel attack ever been used in the wild? Do you mean by criminal hacking groups? If not, the best example I know of is: https://auth0.com/blog/critical-vulnerability-in-json-web-encryption/ If you do mean by criminals, I'm not in the malware/cybercrime part of the security industry, so I have no idea.

Even for 100% FE solutions, the current best practice from OAuth authors [1][2] is to use authorization code + PKCE (optionally, +dPoP). The implicit flow is deprecated (since PKCE), and from OAuth 2.1 it will be removed entirely. [1] https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics… [2] https://auth0.com/docs/get-started/authentication-and-authorization-fl…

Okta is the Oracle of identity management. https://auth0.com is the "still cares about customers" vendor I'm not affiliated with them, just traumatized by working in IT

Yeah, for a similar vendor, it's interesting to read this page and look at the diagram: https://auth0.com/availability-trust And then read this tweet: https://twitter.com/auth0/status/1471159935597793290 Edit: Ah, seems they picked us-west-1 and us-west-2 as the two regions..."In this case, we use two AWS regions: us-west-2 (our primary) and us-west-1 (our failover)."[1] So bit by a double-region failure. [1] https://auth0.com/blog/auth0-architecture-running-in-multiple-cloud-pr…

NIST best practice recommendations state: * Require more than 8 characters * Don't require special characters * Don't force the user to reset their password * Do check for compromised passwords * Require MFA * ... All very sensible. https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/

Auth0 has some good articles on this https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-th… https://auth0.com/docs/best-practices/token-best-practices https://auth0.com/docs/security/data-security/token-storage

Evergreen comment: Don't forget to request your credit per their SLA[0]. You have 10 days to request your credit, which by my calculations should be 10% of this months' charge. Not a fair trade for leaving us dead in the water, but SLAs in general are worthless. [0]: https://auth0.com/docs/support/services-level-descriptions

I am running several projects [0]. One of my latest is https://fromzerotofullstack.com , with video for developers to learn from real projects. For it I use htmx [1], sass [2], Django, Postgres, and Auth0 [3]. I deploy on linode using Ansible [4]. For the videos I use OBS [5] and some custom python scripts. If I need any extra 3d or animation, I use Blender[6] and Shotcut [7]. I have tried other technologies for other projects, like React or Elm (which I find great). But so far this setup (maybe changing custom css by tailwindui mostly) is my most productive. [0] https://mejuto.co [1] https://htmx.org/ [2] https://sass-lang.com/ [3] https://auth0.com/ [4] https://www.ansible.com/ [5] https://obsproject.com/ [6] https://www.blender.org/ [7] https://shotcut.org/ Edit: link format

> Which spec are you referring to? OK, this one's on me. I can't find the reference, and I took an article at face value: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libr… There are libraries that allow Bad Things, though, and best practice now is just to ignore the `alg` field. As the github repo you linked says, "There have been ways to exploit JWT libraries by replacing RS256 with HS256 and using the known public key as the HMAC-SHA256 key, thereby allowing arbitrary token forgery."

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-practices/… where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/

That sounds, well novel. I would encourage you to review: (Free tier) https://auth0.com/ (Free tier) https://firebase.google.com/docs/auth/ Review any other proven and secure user auth solution ie. http://www.passportjs.org/ Questions to asks yourself: How it will scale ? Is it compatible with PAM/LDAP ? Let say you want at least two servers for scale or high availability. How about social login ? How about forgotten password? How you can delegate the work on it ? (in case, you want more people work on it in future) For personal projects, get some paying clients first, worry later.

I recently used auth0 to implement passwordless login (via "magic link" emails) for a client project. Auth0's documentation is not great, but some of their blog posts are pretty good. In any case, if you're interested in WebAuthN, you could do worse than reading what Auth0 has to say about it: https://auth0.com/blog/web-authentication-webauthn-overview-demo-tool/

I have been using JWT[1] since it's initial push as a mainstream authentication method. There's plenty of libraries that support it and make it easier to use[2]. There's even 0Auth[3] that is a company based around offering authentication services. Simply check for a valid token in the Authorization header, check out the introduction [4]. The library I've linked brings up a good point to make sure that you know the difference between decoding and verifying the token, but after that it's fairly plain sailing. [1]: https://jwt.io [2]: https://github.com/auth0/node-jsonwebtoken [3]: https://auth0.com [4]: https://jwt.io/introduction/

We use a local version of UAA (https://docs.cloudfoundry.org/concepts/architecture/uaa.html) he behaves like a google or facebook authentication where the user concedes the permission to the apps using OAuth 2.0 protocol. We have 10+ web clients, 2 mobile apps and one internet gateway. Spring Security make it very easy to integrate everything. https://oauth.net/2/ Auth0 is the best documentation to learn about oauth: https://auth0.com/docs/protocols/oauth2 The best part of using Oauth is that you can change your authentication server (UAA, Auth0, etc) without changing your app code (only configurations)

It would be cool if auth0 (https://auth0.com/) would offer free usage of their service, given the fact that they would only use basic features.