In-house: Platform authentication | Stack | Fluid Attacks Help

In-house: Platform authentication

Rationale

Authentication flows for Fluid Attacks' platform are performed by an in-house implementation. Such implementation currently supports:

  1. OAuth with Microsoft Azure
  2. OAuth with GitLab
  3. OAuth with Bitbucket
  4. Email-based OTP tokens for two factor authentication

The main reasons why we chose it over other alternatives are:

  1. It allowed us to federate authentication for all users so we did not have to store passwords or any other sensitive user information in our database.
  2. It allowed our clients to easily control employee access via their enterprise GitLab, Microsoft Azure or Bitbucket user directories. Once a client removed one of their employees from their user directory, access to the platform was automatically blocked for that user.
  3. Being a basic component of any application, the authentication module started to exist in the early days of our application.
  4. Our needs were simple, we did not need a complex authentication provider at the time.
  5. It just worked as expected.

Alternatives

As the application evolved, so did our interest on using a third-party SaaS authentication provider. Below are the ones we have reviewed, ordered from most to least interesting based on our specific needs. 

Auth0

  1. Auth0 focuses on providing a centralized authentication platform for applications.
  2. It also has started to cover authorization with Okta FGA.
  3. Its Python library is open source and supports asynchronous environments.
  4. It has a Terraform provider.
  5. It has a >99% availability SLA.
  6. It has a pricing model based on monthly active users (pay for what you use).
  7. It supports many popular compliance frameworks and certifications.
  8. If supports most (if not all) public identity providers.
  9. It supports a wide number of enterprise identity providers, allowing us to support protocols like SAML, OIDC, LDAP, Azure Active Directory, Google Workspace, among others.
  10. It implements protections against bot attacks, brute force attacks, etc.
  11. It supports many MFA factors, including push notifications, sms notifications, one-time passwords, email notifications, recovery codes, among others.
Note on Auth0 review date
Auth0 was last reviewed on Jan 22, 2025.

Stytch

  1. Stytch focuses on providing a centralized authentication platform for applications.
  2. It does not provide any extra features outside of its main focus.
  3. Its Python library is open source and supports asynchronous environments.
  4. It has a Terraform provider but it is still in beta phase.
  5. It has a >99% availability SLA, but only for enterprise plans.
  6. It has a pricing model based on monthly active users (pay for what you use) and is cheaper compared to Auth0.
  7. It supports many popular compliance frameworks and certifications.
  8. It supports the most popular public identity providers 
  9. It lacks support for protocols like SAML, OIDC and LDAP.
  10. It implements protections against bot attacks, brute force attacks, etc.
  11. It only supports sms notifications and one-time passwords as MFA factors.
Note on Stytch review date
Stytch was last reviewed on Jan 22, 2025.

AWS Cognito

  1. AWS is one of the most popular cloud solutions provider.
  2. AWS provides many services, among which are cloud storage and cloud computing. In this article we focus on AWS Cognito, an authentication solution for applications.
  3. Its Python library is open source but does not support asynchronous environments. Luckily, the community has been maintaining an asynchronous fork that we currently use.
  4. It has a Terraform provider.
  5. It has a >99% availability SLA.
  6. It has a pricing model based on monthly active users (pay for what you use) and is cheaper compared to Auth0 and Stytch.
  7. It supports many popular compliance frameworks and certifications.
  8. It only supports Amazon, Google, Facebook and Apple as public identity providers.
  9. It supports SAML and OIDC.
  10. Generally speaking, it falls behind in terms or protections when compared to Auth0 and Stytch.
  11. It only supports SMS notifications, email notifications, and one-time passwords as MFA factors.
Note on AWS Cognito review date
AWS Cognito was last reviewed on Jan 24, 2025.

Descope

  1. Descope focuses on providing a centralized authentication platform for applications.
  2. It does not provide any extra features outside of its main focus.
  3. Its Python library is open source but does not seem to support asynchronous environments, making it not usable for us.
  4. It has a Terraform provider but it is still in beta phase.
  5. It has a >99% availability SLA.
  6. It has a pricing model based on monthly active users (pay for what you use) and is cheaper compared to Auth0 but more expensive than Stytch.
  7. It supports many popular compliance frameworks and certifications.
  8. It supports the most popular public identity providers.
  9. It supports SAML and OIDC.
  10. Generally speaking, it falls behind in terms or protections when compared to Auth0 and Stytch.
  11. It only supports WhatsApp notifications and one-time passwords as MFA factors.
Note on Descope review date
Descope was last reviewed on Jan 22, 2025.

Kinde

  1. Kinde focuses on providing a centralized authentication platform for applications.
  2. It also provides services for user management, lead generation and machine-to-machine connections.
  3. Its Python library is open source but is barely supported and does not seem to support asynchronous environments, making it not usable for us.
  4. It does not have a Terraform provider.
  5. It does not provide information about SLAs.
  6. It has a pricing model based on monthly active users (pay for what you use) and is cheaper compared to Auth0 and Stytch.
  7. It supports many popular compliance frameworks and certifications.
  8. It supports the most popular public identity providers.
  9. It supports SAML and Azure OIDC.
  10. Generally speaking, it falls behind in terms or protections when compared to Auth0 and Stytch.
  11. It only supports SMS notifications, one-time passwords and email notifications as MFA factors.
Note on Kinde review date
Kinde was last reviewed on Jan 22, 2025.

WorkOS

  1. WorkOS provides SaaS solutions to requirements usually needed by enterprise applications. 
  2. Due to its broad focus, it provides services for user management, administrative portals, authentication, authorization, among others.
  3. It does not provide a Python library. Instead, it offers either an external GUI or a way to build it using an API. More information can be found here
  4. It does not have a Terraform provider.
  5. It has a >99% availability SLA.
  6. Its pricing model makes it free for up to 1 million users, making it the cheapest option.
  7. It supports many popular compliance frameworks and certifications.
  8. It supports the most popular public identity providers.
  9. It supports SAML and OIDC.
  10. It implements protections against bot attacks, brute force attacks, etc.
  11. It only supports one-time passwords as MFA factor.
Note on WorkOS review date
WorkOS was last reviewed on Jan 22, 2025.

Usage

We use an in-house implementation for all authentication flows at Fluid Attacks' platform.