Open Source Authentication and Authorization I’m Rishabh and the co-founder and CTO at https://supertokens.com (YC S20). We offer open-source user authentication and we just released our user roles product for companies implementing authorization. Our users are web developers, and a prominent and adjacent pain point for our users is authorization. Developers typically implement two independent solutions for authentication and authorization. Offering AuthN and AuthZ in a single solution is something we’ve been thinking about for the last few years. Quick primer, authentication is knowing who the user is, and authorization is knowing what the user has access to. A physical analogy: A person enters a building. Authentication means reading their ID card and knowing that the person’s name is John. Authorization means knowing which floors, offices, and files John has access to. With increasing privacy and data complexity, companies like Netflix[1], Slack[2], and Airbnb[3] have built out their own complex authorization systems. To build our user roles product, we started with a first principles approach of covering authorization use cases using scripting languages such as XACML and OPA. But looking at existing solutions built by talented teams like Oso[4], Aserto[5], Cerbos[6], Strya[7], we realized that while these were powerful solutions, they were often overkill for most early to mid-stage companies (especially on the B2C side). We went back to the drawing board, reached out to our users and after dozens of conversations, we realized that most authorization needs require the ability to 1. Assign and manage roles and permissions 2. Store roles in the DB and session tokens to make it readable on the frontend and 3. Protect APIs and websites based on these roles and permissions. And so, we built user roles – a simple RBAC authorization service that focuses on the balance between simplicity and utility. It doesn’t cover many complex cases and we’re not looking to displace any of the authorization incumbents. But you can add AuthN and AuthZ using a single solution, quickly. In the near future, we’ll be launching an admin GUI where you can manage your users and their roles with a few clicks. We’d love for you to try it out and hear what additional functionality you’d like to see. What are your favorite authentication providers and what do they get right? - [1]: https://ift.tt/jFEx6gV - [2]: https://ift.tt/ipg7Otl - [3]: https://ift.tt/6JyA9Ke - [4]: https://www.osohq.com/ - [5]: https://www.aserto.com/ - [6]: https://cerbos.dev/ - [7]: https://www.styra.com/ November 3, 2022 at 07:45PM
Women Pioneers at Muni: Adeline Svendsen and Muni’s First Newsletter By Jeremy Menzies To close out Women’s History Month, here’s a look back at one woman whose work to bring Muni staff together in the late 1940s created a legacy that lives on to this day. Adeline “Addy” Svendsen was founding editor of Muni’s first internal newsletter, “ Trolley Topics .” Adeline Svendsen sits at her desk in the Geneva Carhouse office building in this 1949 shot. Trolley Topics was a new venture when it started in February 1946. As Svendsen wrote in the first issue it was created, “to bring a little fun, a little news, and a lot of good will to all our fellow employees in the Railway.” Just two years prior in 1944, Muni merged with the Market Street Railway Company, expanding the small municipal operation into the largest transit provider in the city with hundreds of employees, vehicles of every shape and size, and dozens of facilities scattered across town. The newsletter was meant to help unite ...
Comments