Self Managed Auth (Ditch Auth0)

[AdrianAndersen]

It would be really cool to manage auth ourselves, and not depend on Auth0s conventions and pitfalls. Handling this ourselves has multiple benefits:

• Eliminate the need for the Next.js auth proxy, simplifying the communication with the backend
• Kill the pesky three-day timeout enforced by Auth0, where users gets logged out if they are inactive for more than three days. With managed auth, we can set a few months to a year
• Simplify the user signup flow. I imagine inviting a user by email in the GUI, triggering an email with a signup link where they can directly set their name, username, and password. Afterward, they can just log in and use the service. This would significantly simplify the current flow (1. Add user in Auth0, 2. User confirms email 3. User requests password reset 4. User can log in)
• Make user accounts more portable (Auth0 does not allow us to get our password hashes, locking us into their system)

Feel free to use this issue as a discussion board/idea list for the new auth solution.

[mathiazom]

Some good points here 🙌 I think the primary pain points are short-lived sessions and data ownership. Registration links would also be great.

Even though Auth0 turned out to be a poor fit, I am still in favor of using a dedicated provider for handling auth. The lock-in and policy restrictions might simply be solved by self-hosting instead of using a managed solution. That will hopefully give us a more flexible system without sacrificing the benefits of an existing solution designed and maintained by smarter people 🙃 By following existing standards it will probably be easier to integrate with any foreseeable clients as well.

That being said, building a custom solution is still a valid option. Maybe our case is just so simple and niche that it's the most viable one. But I want to give the existing solutions a fair chance first. Rolling our own auth is not a walk in the park...

To kick things off: Keycloack is worthy of investigation. Well-established, open, maintained by Red Hat and compatible with e.g. NextAuth.js.

[AdrianAndersen]

I am neutral as to whether we self host or use a dedicated provider, as long as the pain points of Auth0 gets resolved 😛 The most important thing is to enable data ownership, so that we in the worst case can move solutions if the one we go for has some new pain points. It is so annoying to tell all the users to set new passwords every time we switch providers. 👀

[AdrianAndersen]

Auth.js (formerly NextAuth) seems pretty cool 🚀

[AdrianAndersen]

Not sure I am a fan of their official docs tho, where they suggest you install the beta version 🔫

[AdrianAndersen]

Supertokens seems like a cool alternative to Keycloak https://supertokens.com