Authorization and User Management
Hey y'all,
I would like to know if you are using some kind of authorization and user management solutions for your applications, and side projects?
What solutions do you use?
Are they easy to use?
How do you trust solutions for user management?
Cheers
Using one of the newest libraries for securely managing user sessions. It's called Supertokens. You can check them out here: https://supertokens.io/
They have excellent support and quite easy to use. Also, there is a pretty cool article where they explain how they do it: https://medium.com/hackernoon/the-best-way-to-securely-manage-user-sessions-91f27eeef460
Do you feel limited somewhere? Can you use social logins?
Hey :), I do not feel limited anywhere. And yes, I can use social logins since they do only the session management part and not the login part. The login part is entirely up to you.
This looks very interesting. Thanks for your contribution :)
I lean heavily towards building my own because I can do it quickly and auth is tied to emails, referrals and half a dozen other things. Auth0 often adds complexity for me due to needing to interface with it.
Calling out to a third party can also slow things down and break things. IH is a great example. Login is essentially broken on my mobile browser (DDG). I did find a clever way of logging in, but most users would probably just give and silently leave.
Interesting thoughts. Thank you for your insights.
Hi @MR_LA, I am currently building an IAM platform. One of the features of it is that it is modular: I don't know how familiar you are with OAuth2, but in those terms IdP is something that provides user identity. In many cases people think that identity is same thing as user account, but it doesn't have to be. What is your need?
For how many users?
And are users consumers or business users?
Are users within some protected network or should it work in internet?
Do you plan to have user management (e.g. admin UI) or users self-managing their account?
Should users have account? (stretching the scope with authz)
Is there need for role-based access control?
Are you looking for a commercial (including freemium) hosted service or open-source self-hosted one?
How much you are willing to invest money or time authentication e.g. learning how Identity servers works and how to operate them?
One part of my platform is user management that is going to work with JSON web-tokens (JWT). So if your IdP provides user identity, my idea is to create plug-in user management application with admin UI. Sounds trivial, but at least I haven't found anything easy enough service to cover my needs. There are centralized freemium solutions out there like Okta, Auth0 and also open-source ones like Keycloak from Redhat, but I found them to be too complex and hard to operate to match my needs.
If you want to help me, I would appreciate if you could explain your needs, so that I could validate my assumptions. Thanks!
anyone using firebase auth with react; would like a quick code review. Willing to help?
I generally roll my own, but I got tired of doing that (and everything else) every time. Instead, I'm working on a SaaS starter kit where I can write the auth correctly once (JWT stored in sessions w/ CRSF protection) and then have it ready for all future projects.
If you already have an app in progress that you're looking to add authentication to, I've heard good things about Auth0, but that only solves the backend part of the problem. You're still going to have to write all the "glue" code that connects it to the rest of your site - all the user management, "forgot password" emails, etc.
Thanks for your insights.
That is very interesting. Do you only plan to use it for your projects or do you want to make a business out of it? If so do you have a website, landing page?
What do you think are the biggest challenges for authorization, authentication and user management?
I originally planned on using it only for myself as a basis for new projects, but I quickly realized that this was going to be useful to more people than just me. The website is at: https://nodewood.com/
Security is obviously a huge challenge for auth, and using a pre-written solution will help with that, though there are still things you need to get right at the app level (if your server isn't secure, all the data can be stolen, for example). I think one of the biggest problems people have with user management, though, is just spending a lot of time on it. There's very little value in writing your own user management code - your SaaS users aren't paying you so that they have a great password reset experience, they're paying you for the business solutions you provide. The more time you can spend on writing that business logic and perfecting your solutions, the better for everyone.
That is a cool product. I will definitely keep an eye on that :)
If you want a lot of users to sign up, use Login with Google. Everyone today has a google account and I think I read it here somewhere that out of 500 users only 20 will NOT use google login.
I really dislike platforms that only provide an option to login with Google or another "social service". If you do this, it's always good to provide users with an option to sign up directly.
I think it depends on who are your potential users. I was really against using google for years. My main search engine is still Duck Duck Go. But the majority of people don't care about google's privacy policy so a fast signup process will result in a better user experience.
It's not Google most people have a problem with. It's the fact a site you have never used before is asking you to login with Google or Twitter. It feels invasive compared to using your own email address, and most email providers allow you to use alias addresses so you can identify who is sending you spam or marketing mail.
Do not dismiss how frequently you can lose potential customers when their only options to use your product is by signing in with their Google or Twitter account. Of course, some customers will appreciate being able to sign in with Google/Twitter or another SSO service when that option is also available.
yeah, I guess you are right about this. Once my girlfriend allowed a web app to view her gmail contacts. It was not a good experience. we both panicked till we were able to revoke access.
That sounds interesting... Do you have the article that confirms your numbers?
Here is the link.
https://www.indiehackers.com/product/startday/google-login-vs-regular-email-almost-50-used-g--LzVsMo61s3b85ZRAfLf
I was remembering the numbers from the first comment.
I use Firebase for my current project, and the authentication part is very intuitive to work with. For authorization you have to learn security rules, but I've found them relatively easy to manage.
Thank you for your contribution.
Do you think firebase limits you somewhere or can you do everything with it? Can you use social login?
In terms of auth, I haven't felt limited in any way. Yeah, you can easily do social logins. If you need a custom backend later, you can also parse the Firebase tokens yourself, using the official libraries, if you really need custom stuff.
Enterprise-level SSO is not easily doable though, not to my knowledge. You would have to work around that.
Do you often need to implement Single-Sign-On solutions?
I currently work on a project where that's a requirement. But this is a larger company. I hadn't had the use case to work on SSO for my own projects yet 🤓
are you using that with React?
Hey, if you are asking about the SSO, not really. The auth flow for that is completely server-side. On the other hand, I am using Firebase with React.
Thanks for your insights :)
Depends on the tech stack and the situation. Sometimes I just create the authentication system myself and sometimes I use services like https://auth0.com/ or Netlify identity https://docs.netlify.com/visitor-access/identity/
Thanks for your insights.
How do you decide if you're using a tool or implementing it yourself?
Cost guides every choice I make :p
Hey There,
This is bit of an old post but we have build one which you can connect in minutes and offer custom roles & permission to your users in your SaaS.
We also offer pre-build hosted Admin Page.
Check out = permify.co
This comment was deleted 6 years ago
are you using that with react?
This comment was deleted 6 years ago
This comment was deleted 6 years ago
This comment was deleted 6 years ago
I am currently looking if there is a need for authentication, authorization and user management. Especially with focus on "no-code" solutions.