No need to reinvent the wheel for User Identity Management
This is a guest blog post by Aleksandra Gjinovska, Technical Lead at IT Labs. Check out more content on the www.wearelaika.com blog here.
In this new era of digitalization, one of the most expensive assets in these days is the data. Yet, most of the data breaches are caused by weak authorization, compromised credentials, and poor implementation of access control. For this reason, data protection and security must be priority number one when building a web application.
One of the core components in any architecture is the user management, in particular authentication and authorization. The common thing for most applications is the need to know who a user is and does that user have permissions to perform a given action. We refer to this as Identity management.
Do-it-yourself (DIY) development approach, when thinking about identity management and solutions, should not be underestimated, because it is not free and will waste the resources on something that already exists in the market. Efforts to develop this functionality will keep you away from your core business of delivering value to your end customer. You would agree that’s where an organization's efforts and time should ideally be invested in, right?! Nowadays, companies and organizations are looking for ways to outsource user management to a service provider.
The good news is that there are several identity solutions that exist off-the-shelf that focus on precisely the functionality you need.
Choosing the right identity solution is one of the essential things in the process of designing a system. Simple applications might take care of identity management. But, for larger and more complex systems, that’s not a recommended approach.
Choosing the identity and access management provider depends mainly on the specific business needs and requirements.
Identity, by definition, enables the right people to access the right resources, so authentication is the central piece of any software product.
First thing first, What is an IdP? The core element of any identity management solution is the identity provider (IdP). IdP is a centralized place for storing digital user identities. The identity management solutions available are continually increasing. There are a variety of services available, and one must ideally choose wisely to satisfy the business needs on one side, and also make sure its delivered on-time and on-budget.
Azure AD B2C
Azure AD B2C is a delivery manageable Customer Identity & Access Management system (CIAM), providing business-to-customer identity as a service. It’s a cloud-based service, built on top of Azure Active Directory. While Azure Active Directory should be the choice for corporate scenarios to provide SSO service, Azure AD B2C is more suited for public-facing applications, which deals with external users.
Azure AD B2C serves as a direct replacement for managing user identity database and authentication.
Azure AD B2C guarantees security on top of the two standard protocols: OpenID Connect and OAuth 2.0. While also providing seamless integration with your SaaS or on-premises applications, with 99.9% guaranteed availability. But note, for free-tier, no Service Agreement is provided. In case of issues, one can only expect action if a ticket is raised with the Microsoft team, with the response time based on the agreed service plan that you have in place.
Data storage for Azure AD B2C is located in the United States, Europe, or the Asia Pacific region.
Setting up the Azure AD B2C can be an easy-going user-friendly experience trough the Azure portal.
Azure AD B2C gives the ability to have the same look and feel as on your application, (e.g. while signing in, signing up, password resetting etc.), all this can be easily achieved through the UI, via user flows or custom policies. The recommended approach here is to define custom user-flows through the Azure portal for either for password resetting or sign — up process.
User flows provide several built-in templates. They also offer the flexibility to use customized HTML and CSS. The customized UI content should be hosted on any publicly available HTTPS endpoint that supports CORS, like AWS S3, CDNS, or Azure Blob storage. Now, there is a brand-new feature named Company branding, that enables injecting banner logo, background image, and even background color. Unfortunately, at the moment of writing this article, this is in the state of public review. In any case, any additional customizations can be done with custom JavaScript code.
Multi-Factor Authentication
An additional security step is the possibility to enable multi-factor authentication. By using custom-policies, one can configure password complexity (Note: the default password complexity is set to strong). Any policy requirement can be enforced as needed, together with required error messages that dynamically update as requirements for the password are met (or not).
Azure AD B2C also provides language customization, either by using the 36 Microsoft supported languages or by using customer’s translations, that are not provided by default.
With Azure AD B2C, we can use either social identity providers like Google, Amazon, Facebook, LinkedIn, Twitter etc., or external identity providers that support standard identity protocols like OAuth 2.0, OpenID Connect, and many more.
For each token issued, administrator access, Azure AD B2C emits audit logs, that are available for seven days. Azure AD B2C provides activity reports for each admin sign-in, along with usage reports for the number of users and number of logins. These can be used to analyze the data and create alerts on specific events.
Pros:
- Secure, using OpenID Connect and OAuth 2.0 protocols
- UI customization, page look & feel can be customized
- Localization
- MFA
- 99.9% availability per SLA
- SSO
Cons:
- Not cost-effective
- The data can be accessed only through PowerShell to Azure AD
Identity Server 4
In the list of identity solutions, Identity Server 4 has been the solution that many turn to initially. Identity Server 4 is open-source and free to use. It provides a centralized login flow for all applications, either web or mobile.
Identity Server 4 has built-in support for OpenID Connect and OAuth2 protocols. SAML plugin is available in case one needs to support SAML based IdP.
Also, Identity Server 4 has support for external identity providers like Facebook, Azure AD, Google, etc.
Identity Server 4 is middleware that can be used to make the authentication an authentication server hosted on a separate instance.
From a scalability perspective, this server does not provide scaling out of the box. However, this can be achieved by putting a load balancer in front of the service.
Despite logging, the emitting events provide more useful information. These events contain data in a structured way.
Direct access to the user identities in the database makes it easier in case of migration activities.
If you would like to try out this solution, there is a handy demo instance of the IdentityServer4 to play with.
The most significant advantage of the IdentityServer4 is that it is open-source, so the full code base is available on GitHub, and therefore can be customized as per the needs of a particular use-case.
When talking about customization, in case of a multi-tenant solution, separate tenant pages can be implemented, and the internal navigation can be achieved by extending the AuthorizeInteractionResponseGenerator class and overriding the ProcessInteractioAsync method.
Since there is no user interface (neither for admin purposes), the IdentityServer4 can only be configured by directly updating the database or making changes in the code itself. Luckily there is a plugin that addresses this. If there is a need for out-of-the-box admin UI, there is a paid admin plugin for precisely this purpose.
Pros:
- Core solution: free of charge
- Good documentation
- Easily extendable
- Configuration as a code
- Since it’s a framework and not IaaS, we can adapt it to our system by writing extending code
Cons:
- Multi-factor authentication is not enabled, it needs 3rd party solution
- Localization: needs to be developed
- The server’s code template lacks:
- user registration.
- ‘forgot password’ functionality
- MFA or Google Re-Captcha.
Amazon Cognito
Amazon Cognito is a user & identity management cloud service, enabling the management of users in one place across multiple devices. It provides the possibility to sync all user information in one place securely and in a straightforward manner, with the ability to scale to hundreds of millions of users.
The two core services provided by Amazon Cognito are User and Identity pools.
User pools act as an Identity provider, storing user information’s, and providing authentication information.
The authentication process resides within the Amazon Cognito user pool returned token. As defined in the OpenID Connect open standard, the ID Token contains basic unique information about the identity of the user. The Access token data is in a form that scopes which groups are granted access to a given authorized resource. Refresh token contains information needed to get new Access or ID token.
Amazon Cognito gives the possibility for customization on multiple levels by using Lambda triggers. Either that’s a custom welcome message after a successful sign-up process or a trigger that will migrate an existing user directory (like AD) to user pools. Also, lambda triggers can be used for the pre-generation of a token, so the claims in the ID token can be modified. Post Authentication triggers might be used to send logs to CloudWatch (e.g. if a user has signed in from a new device).
For strengthening security, multi-factor authentication can be enabled from the UI. The two provided options are, sending an SMS, or using a Time-based One-time Password. An everyday use case would be to use a Time-based One-time password as a second step while authenticating, and keeping the SMS flow option for “forgot password” functionality.
Also, password policies can be customized based on particular use-cases.
For applications that provide a trial option, where the users can play around with the product/service before purchasing, Amazon Cognito has a perfect solution by using guest login, which enables restricted access.
Pros:
- User directory management and user profiles
- Easy for sign-in and sign-up (resulting in faster development)
- Sign in using social network providers like Google, Facebook, Apple.
- MFA
- User migration trough AWS Lambda triggers
- SSO
- Supports access management via OAuth 2.0 (making authorization easier)
Cons:
- Expensive security options
- Less configuration control (compared to other options)
- Not well-organized documentation
IDP COMPARISON TABLE (CLICK TO DOWNLOAD)
Conclusion
These days we rely on identity providers to securely connect our users to technologies and devices. Choosing the right identity solution must be made by taking into consideration the business value and the budget available, but without compromising security or chosen security protocols. Also, keep in mind the scalability and SLA of the solution.
Follow the “do not limit a user” approach by choosing a solution that provides various authentication methods layered with a user– friendly experience. The chosen IdP should protect the user identities without making it challenging or painful for the end-user.
