[itwasntandy]

GitHub repo: https://github.com/buzzfeed/sso

This is our identity aware proxy, which we've been using internally for a year.

The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license.

We'll be keeping an eye on the thread, and happy to follow up to any questions!

[Signez]

Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little organizations <3

[itwasntandy]

thank you - We know from our own experience using other open source projects that having documentation, and guides to get started really helps.

We know there is more to do there too (some of the feedback in this HN post has helped highlight areas we need to improve the docs) and we will be adding to the docs so over the next while.

We will also welcome PRs improving the docs!

[snuxoll]

Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?

[itwasntandy]

Hey,

there were a few reasons behind this.

- ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected.

- ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/deploy-with-haste-the-story-of-rig... ).

- when we built this, there were far fewer solutions than there are today. For example, Ory's Oathkeeper ( https://github.com/ory/oathkeeper) was released after we were already using sso internally at BuzzFeed.

thanks!

[ashayh]

Is it possible to use this with Nginx auth_request? I use bitlys oauth2_proxy like so because it doesn't support websockets.

[itwasntandy]

Maybe - we've not tried it, but I just asked Justin who architected sso, and he suggested that maybe https://github.com/buzzfeed/sso/blob/master/internal/proxy/o... could be used.

However there would be some caveats - like for example `skip_auth_regex` (see https://github.com/buzzfeed/sso/blob/master/docs/sso_config.... ) would not work with this, because the original URI would not be checked.

[andremat]

Have you contracted an independent pen-testing company to assess your design and implementation?

[itwasntandy]

Yes, as mentioned in the blog post, we worked with Security Innovation to do a week long security assessment with full access to source code, design documents and endpoints.

We also have a long term consulting arrangement with a widely respected security architect, and they helped review our design and implementation.

Additionally, BuzzFeed has a bug bounty program on hackerone (https://hackerone.com/buzzfeed), and have invited partipating researchers to report on any issues found. We’ve paid out bounties for a number of minor issues, which were addressed prior to open-sourcing.

Additionally, knowing that security is never done, we continue to make it eligible for bounties -- see https://github.com/buzzfeed/sso/blob/master/README.md#securi...

[kingbirdy]

This is mentioned in the article

> In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon as clients, to do a more in-depth, week long assessment, with full access to source code and design documents. This found no major issues, which gives us the confidence to open source sso today.

[baby]

It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.

[itwasntandy]

That is understood, and is always why we engaged with some of the top researchers who contribute to our bug bounty program, from the start with this project.

For example offering increased bounties during certain windows, or providing early access to the source code.

We highly value our bug bounty program, and find it to be a very effective mechanism for continuous security validation.

I'll write a tech blog post in the near future about how we facilitate our program.

[yubozhao]

Looking forward to read about it. Thank you for the project!

[Dowwie]

How have you found working with Go?

[itwasntandy]

Golang is pretty beloved at BuzzFeed.

It’s one of our two standard languages - the other being Python - and whilst the vast majority of our services are Python, Golang is being used for growing and significant number too.

Touching on my first point, we have observed people enjoy writing Go apps, and it is a great fit particularly where performance and scalability are needed.

Therefore when engineers have moved to another team internally, they often will evangelize Golang to their new team members.

So we expect it to continue to grow and thrive here!