Re:If it's a nice problem to have, don't solve it now
by nbadg on Monday August 10, 2020 @06:42PM
(#24114960)
The thing is, that's not just a technical decision. There are strategy, product, and operational reasons why you might decide to add or avoid SSO. SSO for sign-on can be really complicated and have lots of caveats -- for example, Apple requires any app with any SSO option to also support sign in with Apple, or be removed from the app store. Or you may want to restrict certain SSO to enterprise customers only, as a feature, but not have any of them yet. Or your users might have privacy concerns about SSO, or not have accounts at your SSO providers.
Any of these things may or may not be relevant to your decision, and I know that authentication is a specific example within a larger point. What I'm trying to say is that it's never correct to say "<x> is the right approach for all <y> trying to do <z>". Every decision has consequences, and what really matters is your ability to foresee those consequences and weigh them against the broader strategic picture of what you're trying to accomplish.
Re:If it's a nice problem to have, don't solve it now
by bredren on Monday August 10, 2020 @05:33PM
(#24114254)
I think this was an example based on the op example.
Re:If it's a nice problem to have, don't solve it now
by MaysonL on Monday August 10, 2020 @07:01PM
(#24115141)
Assuming that Google or Facebook or Github has implemented a library correctly, and that it will remain available as long as you want your app to function is dangerous.
Re:If it's a nice problem to have, don't solve it now
by Dudenoso on Monday August 10, 2020 @07:43PM
(#24115558)
As opposed to assuming that you'll implement it correctly when Google or Facebook or github haven't?
Re:If it's a nice problem to have, don't solve it now
by yjftsjthsd-h on Tuesday August 11, 2020 @01:30AM
(#24117437)
Yes, because what's good for them is not necessarily what's good for you.
Wrong. The correct technical decision is to bundle in a library that solves this for you - login with Google, or Facebook, or GitHub, or OIDC, pick one according to the context. Get password reset, MFA, password security, etc. for free.
Why reinvent the wheel, poorly?