There are auth libraries that you can just plug into your app so you don’t even have to worry about that part yourself and just focus on the app
Comment on Single Sign in for Home Assistant now possible with OpenID
Flipper@feddit.org 2 days ago
If i created a service I would go in the opposit direction. Only offer SSO and no other option.
You loose quite a bit of complexity that way.
Lem453@lemmy.ca 2 days ago
Flipper@feddit.org 2 days ago
By default, the Credentials provider does not persist data in the database. However, you can still create and save any data in your database, you just have to provide the necessary logic, eg. to encrypt passwords, add rate-limiting, add password reset functionality, etc.
That is exactly the complexity I wouldn’t want. With just SSO it is enough to send a redirect URL to the browser and on the callback set a cookie. No js needed. If your service gets compromised and someone leeks the credentials, just log everyone out.
irotsoma@piefed.blahaj.zone 2 days ago
Problem is requiring a browser if it’s not primarily a web interface. Even if initial setup is web-based, a lot of times background processes exist that don’t traverse the internet, especially in higher security situations, so exposing those components to the internet just to get external credentials is not worth it, so then an additional proxying component is required. Anyway, the idea is that it can add a significant amount of complexity if it’s something more complex than a simple, single component web application.
femtek@lemmy.blahaj.zone 22 hours ago
You can self host the authentication outside of the Internet.
illusionist@lemmy.zip 2 days ago
I would hate it if google and apple would be the sole identity providers. If they lock me out, I’m lost. That’s what a majority of people do. And services have the power to choose the identity provider. Most offer only that and that’s horrible.
Flipper@feddit.org 2 days ago
I should have been more clear.
I meant for self hosting.
Though realistically, even if the service is provided for the public, you could just use an instance of keycloak or something similar with open registration. That’s what an association I’m close to is doing already.
illusionist@lemmy.zip 2 days ago
I see you. There are spillover effects. If we don’t use and support passwords, others wont either.
It’s not even that my government provides the identity but a foreign, autocratic, power hungry company
boatswain@infosec.pub 2 days ago
With keycloak you can have a single local password to all your selfhosted apps: you sign in to keycloak, then you sso into everything else from there. I’m building that out on my homelab right now, and it’s working fine.