HN Explorer

Show HN: Open Source Authentication and Authorization

128 points by rishabhpoddar ↗ HN
I’m Rishabh and the co-founder and CTO at https://supertokens.com (YC S20). We offer open-source user authentication and we just released our user roles product for companies implementing authorization.

Our users are web developers, and a prominent and adjacent pain point for our users is authorization. Developers typically implement two independent solutions for authentication and authorization. Offering AuthN and AuthZ in a single solution is something we’ve been thinking about for the last few years.

Quick primer, authentication is knowing who the user is, and authorization is knowing what the user has access to. A physical analogy: A person enters a building. Authentication means reading their ID card and knowing that the person’s name is John. Authorization means knowing which floors, offices, and files John has access to.

With increasing privacy and data complexity, companies like Netflix[1], Slack[2], and Airbnb[3] have built out their own complex authorization systems.

To build our user roles product, we started with a first principles approach of covering authorization use cases using scripting languages such as XACML and OPA. But looking at existing solutions built by talented teams like Oso[4], Aserto[5], Cerbos[6], Strya[7], we realized that while these were powerful solutions, they were often overkill for most early to mid-stage companies (especially on the B2C side).

We went back to the drawing board, reached out to our users and after dozens of conversations, we realized that most authorization needs require the ability to

1. Assign and manage roles and permissions

2. Store roles in the DB and session tokens to make it readable on the frontend and

3. Protect APIs and websites based on these roles and permissions.

And so, we built user roles – a simple RBAC authorization service that focuses on the balance between simplicity and utility. It doesn’t cover many complex cases and we’re not looking to displace any of the authorization incumbents. But you can add AuthN and AuthZ using a single solution, quickly.

In the near future, we’ll be launching an admin GUI where you can manage your users and their roles with a few clicks.

We’d love for you to try it out and hear what additional functionality you’d like to see. What are your favorite authentication providers and what do they get right?

- [1]: https://conferences.oreilly.com/velocity/vl-ca-2018/cdn.orei...

- [2]: https://slack.engineering/role-management-at-slack/

- [3]: https://medium.com/airbnb-engineering/himeji-a-scalable-cent...

- [4]: https://www.osohq.com/

- [5]: https://www.aserto.com/

- [6]: https://cerbos.dev/

- [7]: https://www.styra.com/

35 comments

[ 2.3 ms ] story [ 87.0 ms ] thread
0xbadcafebee
Stupid question: judging by your feature comparison, the only thing you have over Keycloak is you provide managed instances. So why not just be a Keycloak managed provider? They also seem to have features you lack?
rishabhpoddar
There are other differences too:

- Our architecture is different: We provide a frontend SDK with react components that are embedded in your own website - giving you more control and a better dev experience. The frontend doesn't talk to SuperTokens directly, but instead proxies requests via your backend API layer (using our backend SDK). This makes it much easier for you to customise the backend auth logic (you can reuse your API code and also are not forced to use Java), and also enables us to handle your app's session management out of the box.

- For use cases that don't need OAuth (for example if you have a single website), we don't require you to use the protocol. This makes it simpler to setup auth, especially for people not familiar with OAuth and its various flows already.

- There are other feature differences - some features that we have that they don't and vice versa. But this is just a function of time investment on either side.

[dead] ryhotsi
[dead]
[deleted]
(comment deleted)
ignoramous
> So I have to ask, with software coming out of things like Zanzibar and open source implementations around it - why did you decide to build the same thing again, instead of collaborating with one of these projects?

Supertokens is not a recent project.

Previously:

Launch HN: Securely manage tokens (Aug 2020), https://news.ycombinator.com/item?id=24306572

Show HN: Stripe for Auth (Dec 2020), https://news.ycombinator.com/item?id=25458033

Auth0 alternative (Aug 2021), https://news.ycombinator.com/item?id=26880554

gneray
Looks like that account was created shortly after the post was posted, so I think we can ignore
notlukesky
Ory Keto is in Go. Maybe they wanted an alternative available in Java perhaps?
advaitruia
But the problem is, permissions are actually a representation of business processes snd communication structures. They are rarely user <-> role <-> permissions (I wish they were!).

Thats true.

For us this was about coupling authorization with an authentication system so that developers could have both with a single product.

brightball
Looks like a really interesting platform with extremely reasonably pricing. I might have to try it out soon.

Question on your 2FA though. It says "Partial" and lists that you don't have app access. What does that mean you do have though? FIDO/webAuthn?

If I was self-hosting the open source version at auth.mydomain.com would I be able to export the data, load it into your cloud offering and point the domain to your service for a hiccup free transition for site users? What about the reverse?

I like what I see so far though. Definitely a project to keep an eye on.

rishabhpoddar
The reason it says Partial is cause we don't have 2FA with TOPT at the moment. This feature, along with FIDO / webAuthN are in our dev pipeline.

> If I was self-hosting the open source version at auth.mydomain.com would I be able to export the data, load it into your cloud offering and point the domain to your service for a hiccup free transition for site users? What about the reverse?

Yes you can - both ways.

aidos
Implementing SuperTokens is on my roadmap. I’ve read through the docs and been lurking on discord. The approach having your own layer in front of theirs to augment everything sits really well with me.

I wish you guys all the luck, I think it’s a really interesting product.

advaitruia
Thank you Aidos! Thats what makes SuperTokens different from the others
Zeik0s
Sounds to me a bit like https://zitadel.com/
mffap
Thanks for mentioning ZITADEL. Co-founder here. Supertokens is a good solution with obviously a lot of open source traction, which is great to see in this space. Expanding to authorization makes a lot of sense. ZITADEL supports both authentication and authorization in a turnkey solution (AuthN, AuthZ, APIs, UI, DB). Looking at Supertoken's roadmap, Zitadel seems to be more feature rich offering Passkeys, OTP, multi-tenancy, account linking and a management ui.
mirzap
Zitadel looks interesting, but their website is quite confusing. I'm not sure is it open source and free to use (as keycloak) or you need a commercial license to use "open source".
mffap
The software is open source under Apache 2.0 (https://github.com/zitadel/zitadel). No open core or similar, we run the same version on our Cloud Service and for Enterprises. Thanks for the feedback, we need to make that more obvious then.
pakl
In my experience, businesses are especially concerned with authorization — enabling product sales to customers.

They would rather not deal with identity and authentication — usernames and passwords — at all. These are already quite nicely handled to various degrees by Cogntio, Auth0, Azure Active Directory, and others.

To address minimalist authorization needs, the portfolio of companies I worked with collaborated to create The Usher[1]. The Usher is an open source authorization server in NodeJS. Worth a peek if you, too, want to focus on authorization separate from authentication.

Disclosure: I am a contributor to The Usher.

[1] https://github.com/DMGT-TECH/the-usher-server

aliqot
This pricing is very reasonable, you can tell they want your SaaS to grow with them. I'm going to find an excuse to give this a shot, if anything just to see if the experience matches the presentation, because they nailed it.
advaitruia
Thanks aliqot! Would love to hear your feedback once you do
jaflo
I really appreciate the “free up to a cap” and reasonable pricing. Makes me much more likely to try this for a side project unlike competitors who want me to commit to paying right off the bat.

One thing I noticed is that the link to themes (which I was hoping to see a demo at) is broken: https://supertokens.com/docs/emailpassword/common-customizat... under pricing

rishabhpoddar
Thanks for letting us know about the broken link :)
oli5679
What do people on HN use for Authentication?

I've gotten quite used to Firebase + Firebase authentication for some side-projects. Now I'm interested in some other cloud hosting providers (Supabase + Render) and one of the key things making me want to keep using Firebase is that I'd have to learn a new auth system.

bhargav
Your code is open source and free for self-hosting. You have a paid managed model. I really like this model and want to adopt it, but have always wondered how this works out for most companies. Do most people opt for your managed solution? Is it enough to keep paying the bills? Do you have outside contributions thanks to the projects being open sourced?
advaitruia
At the moment, our usage skews in favour of self hosted.

Yes, we do have outside contributions.

Over the long term, revenue will be from 1. hosting (as you mentioned), 2. Enterprises that pay for closed source features (regardless of whether they host with us or on their own infra)

I_am_tiberius
I have a question. Can I protect a graphql api as well with supertokens?
advaitruia
Yes! We have docs for this (both with and without hasura)
abskscdv
I used it recently and really liked the experience specially SDKs.

Support on their discord community is also great.