A large subset of these services is comprised of tools that support our content creation and business teams, which means we need to have a secure way for users to access these internal services. Today, BuzzFeed’s software ecosystem is comprised of hundreds of microservices that interact with each other in various ways. In this article, we’ll explore one pain point in particular: authenticating and authorizing access to internal services. The transformation was wonderful-we went from struggling to deploy several times a week to deploying 150 times a day! However, as anyone who has made the move to microservices can attest, there were pain points in migrating to a much more distributed set of services. Rig is our opinionated Platform as a Service (PaaS), which enables high-velocity development and productionizing of services. Over time, when both the engineering team and its monolith application had doubled in size, we came to a familiar realization for companies of our size: We lacked the sophistication of infrastructure and tooling to support the organizational model of our teams and systems. When BuzzFeed launched over 10 years ago, we started, as many companies do, with a glorious single application. It provided us with what we saw as a novel solution to a common industry problem, so we made a commitment to open source it-to provide that tried and tested solution we too had been searching for in the past. Thus, we created sso, a centralized authentication proxy of our own. However, while we heard from our peers that this was a common problem, we never found something that met our specifications. So we did what any good engineers would do: We looked for other existing, tested solutions in open source. This solution was reliable, but it lacked a centralized way for our users to sign on, which presented a handful of challenges for our growing platform.

At BuzzFeed, our security infrastructure team experienced this tension when our newly developed microservice ecosystem began to outgrow our existing auth patterns, which relied on Bitly’s tried and tested oauth2_proxy. Many security teams are plagued by the eternal question of whether to “build” or “buy” technical solutions for the complex challenges they face.

Beyondcorp open source software