How to outsource password and account management to a third party?

Question

I read that storing passwords yourself, handling lost passwords and accounts etc, is a complicated process, and involves a lot of work if you don't want to take security risks.

I am building a website for which security is very important. I thought it would be good to start with not trying to handle that myself, but outsource it to an external service.

What I am looking for is something a bit like "Log in with Facebook", or "Log in with Google", except that :

• I can't use those websites nor Twitter because in themselves I will propose later on to users to link their accounts on those services, so it can be confusing if I also use them for password and account management. (For example, someone coming to the site to link to Twitter wouldn't understand if I ask them to login with Facebook)
• I'd like to enable users to easily have an account just for my website. If using their Google account, it is used on other websites as well (at least for Gmail for example). What I would like is for users to be able to create an account just for my website.

Any idea of a service provider for this ?

Thanks in advance !

Answer 1

For example:

• parse.com
• stormpath.com
• auth0.com

Answer 2

I just wanted to give you a heads up that Stormpath now includes user interfaces in two ways:

1. Our ID Site feature which is basically hosted login screens you can use with any app (or even centralize login across multiple apps).
2. Views and default screens built into framework-specific sample apps:
   • Stormpath-Express
   • Stormpath-Passport-Express
   • Stormpath-Flask

We're working to get screens into all of our sample apps, so let us know if you're looking for something in particular. We can probably get you some code to get started. [email protected]

Answer 3

If it's helpful for anyone else, I compared (5/18/2015):

• Auth0
• AuthRocket
• UserApp
• DailyCred

Conclusion for me was Auth0, because while all the features are very similar, it felt the most legitimate, as in it's not a start-up that might disappear in a few months. Now, the reason that was super important for me was because login is a foundational requirement, so I need to believe as a customer that the Authentication as a Service will be up for as long as I will be.

Here's the full comparison story: https://medium.com/@bsemaj/authentication-as-a-service-comparison-5-quick-lessons-for-b2b-businesses-e7587275824c