128. What Authentication System Should I Use For My App?

What are the pros and cons of the various authentication systems? Should I use the built-in authentication system in ASP.NET Core? Should I use a third-party system? Is Azure Active Directory the right choice? These are the questions we will answer in today's episode of Dev Questions.

[jackt]

I can summarize this video in one sentence:
"The more important the information is that you are storing, the better system you need to protect it."
What you won't find are insights of the available technologies and products and how they work that you could use to help you choose the best fit for your situation.

[hassaanindominus]

I love the analogies and terms "Keep the walls high".
Loved it absolutely!

[Gbtx]

Tim Corey videos in 4k are at whole 'nother level. Truly appreciate the work Tim <3

[anyaplays]

I would use "Sign-in with Microsoft" or something similar for the software I make, but it's a kind of offline software (ERP) and in Germany most business owners don't like anything outside of their own building. They don't seem to trust third parties on the internet that much. At least that's what I've been told by support. Support talks to customers, I rarely do.

[eveloth]

Nice video, I'd like to add something — there is actually one more situation, when you can (and maybe should!) build your own auth system: if you really want to know, how it works. You'll learn literally tons of stuff! If you've built it, don't build your buisiness around it ofc :P But 'building your own and do the research' is one of the best learning curves imo.

[BrendanAlexander]

Thank u for this video! Was "this close" to spinning up my own Identity Provider with Duende. But following your suggestion, I decided to go with Azure Active Directory B2C.

[yashseth]

I have recenlty started App development and just wanted to know different ways of authorization, , before this i have never thought of like this, ,figuring out risk to reward ...The explanation was good even for freshers like me ...

[darthgugans]

Perfect timing Tim! I’m trying to dive deep in this subject, and I see such a widespread association of these “3rd parties” with microservices that I was wondering if it’d be an overkill to apply it on traditional monolithic web applications. At least I got rid of the DIY idea. 😄

[nnndddccc]

I was hoping for a comparison between identityserver vs auth0 vs okta or others but this is also good

[kevingrems]

Literally just got back from a 3-day NDC conference about this topic. Great summary.

[muttBunch]

Great analogies, great information. Damn I love Tim!

[FcoGalaz]

between Azure AD B2C and Auth0 for a SaaS startup, which would you suggest? We will strictly force to only sign in with email and password, no sign in with google, microsft, etc

[dogacozen]

what about keycloak? which level is it? do you recommend it?

[Doyle-nx]

Hi, do you think using something like Spring Boot Security or identity management with Entity Framework and JWT would be sufficient for an internal app? I feel that using a third-party service for authentication and authorization might be overkill. Since it's a desktop app, I believe email and password authentication should be enough. However, the backend will be in the cloud. I'd love to hear your thoughts on whether it's better to use OAuth, Keycloak, Azure AD or any other third-party

[bobiyo]

I have always marveled seeing young developers naively attempting to do authentication themselves from scratch. It's not possible to have worked on a real world project and even remotely think that it would make sense to try this yourself. Thanks for these deep insights Tim

[pawelpawel]

Damn you are a telepath 😂. This video is right on time. I am trying to figure that out for quite some time.

[vktop]

Excellent video Tim, but how can I work with authentication and JWT with embedded widget, if I make the widget available to a third party company?

[מתןשולמן]

excellent video and explanation as always. Thank you !!!

[andywalter]

One question. What is a business supposed to do about authentication if they are starting out and can't afford any money for a third part authentication system? Also, what if a person can't even figure out how to get a third part authentication system to even work? I had cases where I was unable to use a third part authentication system. The 2 past jobs, I created my own and did not have any problems with it.

[Otonium]

This is the kind of info I was looking for. Thanks. I need to see more code about this. :)