Authentication Series Introduction

04 Nov 2024 by cthos
458 words

_{Design by me, affinity designer. I spent 4 minutes on it. I'll do better next time.}

Hey there friends, I've decided to do something outside of my normal one-off posts and talk about something near and dear to me. Authentication.

What can I say, it's a passion.

I was inspired to write this series by Mayank on Mastodon when they commented about the lack of how-to guides on the bare metal portions of authentication. I've spent a lot of time thinking about authentication, authorization, and access management (or Identity and Access Management, if you prefer / are in corporate life) since I started my career. This arguably started back at my very first tech job and was volunteered to learn how the heck SAML 2.0 worked, so that we could offer it as an authentication method. This was back in the time where the only library for PHP was SimpleSAMLphp and there was basically no documentation on how SAML worked besides the specification. So, I read the spec. I dug through SimpleSAMLphp's source code. I ignited a life-long spite-relationship with authentication systems.

Now I hope to share that pain with all of you.

That said, I'm not actively involved in working groups and this isn't my day job (anymore), so I'll be sure to include links to folks that are more reputable than me so you can double-check my work if you want to do so.

I don't know how many parts this series is going to be, but I want to start with authentication for the web (since that's what I'm most well versed in).

Here are the list of topics I want to cover:

1. ✅ Passwords and how the server knows you are you.
2. ✅ Multifactor Authentication.
3. ✅ SAML 2.0 and OAuth / OpenID Connect (OIDC).
4. ✅ Passkeys / Passwordless authentication.
5. Common pitfalls and vulnerabilities (these will be mixed in with each post).
6. Kerberos / LDAP / other less-web-centric systems?
   1. This wound up in the last post "The Other Stuff"

I'm going to start with #1 next week, and will adjust this list as I plot out the rest of the post series. If this is something that's interesting to you, I encourage you to subscribe to the RSS feed which includes the whole post. Alternatively, I'll be posting about each of these on Mastodon and Bluesky.

If there's anything you're particularly curious about, comment below or tag me on either on of those socials! 👋🏻