How to transfer third-party password and account management to a third party?

Question

I read that storing passwords on my own, handling lost passwords and accounts, etc. is a complex process and requires a lot of work if you do not want to compromise security.

I am creating a website for which security is very important. I thought it would be nice to start with the fact that I myself did not try to deal with this, but transferred it to an external service.

I am looking for something like "Log in to Facebook" or "Log in to Google", except that:

• I can’t use these websites and Twitter, because on my own I will offer users to link their accounts with these services, so it can be confusing if I also use them to manage passwords and accounts. (For example, someone coming to the site to contact Twitter would not understand if I asked them to log in to Facebook)
• I want users to be able to easily have an account for my site only. If you use your Google account, it is also used on other sites (at least for Gmail). I would like users to be able to create an account only for my site.

Any idea of ​​a service provider for this?

Thanks in advance!

Answer 1

For instance:

• parse.com
• stormpath.com
• auth0.com

Answer 2

I just wanted to make you understand that Stormpath now includes user interfaces in two ways:

• Our site identifier function , which mainly contains login screens that you can use with any application (or even centralize registration in several applications).
• Default views and screens built into sample applications targeting specific applications:
  • Stormpath express
  • Stormpath-passport-express
  • Stormpath-flask

We are working to display screens in all of our sample applications, so let us know if you are looking for something in particular. We can probably get the code to start. [e-mail]

Answer 3

If this is useful to someone else, I compared (05/18/2015):

• Auth0
• Authocket
• Userapp
• Dailycred

The conclusion for me was Auth0 , because although all the functions are very similar, it felt the most legitimate because it did not have a launch that could disappear after a few months. Now the reason that was very important to me was that login is a basic requirement, so I need to believe as a client that authentication as a service will work as long as I will.

Here's the full comparison history: https://medium.com/@bsemaj/authentication-as-a-service-comparison-5-quick-lessons-for-b2b-businesses-e7587275824c