Full transcript
0:00All righty, hi everyone. Thank you so
0:01much for tuning in. Look, I am excited
0:03to chat with a new friend, Fletcher.
0:06Fletcher Heisler, the CEO over at
0:08Authentic Security. And hey, I think we
0:11got a lot of fun stuff to talk about.
0:12But Fletcher, would you mind filling in
0:14the gaps? I don't know, who are you?
0:15What are you up to? What's going on in
0:16your world and at Authentic these days?
0:19Sounds good. Thanks for having me, John.
0:20So, Authentic Security, the company, has
0:22been around a few years and I am CEO
0:24there. Our founding CTO, Jens, started
0:27Authentic, the open source project, in
0:292018. So, it's been around quite a
0:31while. Essentially as an IDP because
0:34nothing could do what he wanted back
0:36then. So, it's been a long journey
0:38toward building a full-fledged IDP and
0:40then some. It's primarily an open source
0:42project, but we have an enterprise
0:43version. And so, it's entirely focused
0:46on self-hosted right now. We've seen a
0:48surprising amount of traction just
0:50within that space from a growing set of
0:53customers and then companies who want to
0:55host their own identity and run it
0:57within their own infrastructure. A lot
0:58of folks are seeing even at scale, you
1:01know, they're building a bunch of duct
1:03tape on top of an Octa or Ping or Entra
1:05or maybe all three of those put together
1:07plus some Keycloak instances. And we
1:09want to be the glue that then subsumes
1:12all of that and makes that very easy to
1:13do in in one place. So, you know, we've
1:15been building that a long time. We just
1:17announced, sort of, I'm sorry to say
1:19another acronym, uh XIM. So, XIM,
1:22extended identity and access management.
1:25Really encapsulating what we've been
1:26trying to to build toward that it's all
1:28users. So, it's B2B and B2C and B2B2C,
1:32etc. Uh as well as service accounts. So,
1:34agents, you know, non-human identities.
1:36Everything automatable for every device.
1:38Everything's an API on the back end. You
1:40know, really best practices, very
1:42flexible, very secure, built out in the
1:44open. So, we're excited with uh where
1:46we've gotten to today with a lot of big
1:48rollouts and a lot of interest for for
1:50growth this year as well. Well, hey,
1:52I'll admit we were bantering a little
1:53bit before we started to record. And I
1:55was saying, "Look, you know what?
1:56Honestly, over on my side, over John
1:59Hammond LLC and all, a couple of us have
2:01been putting together different capture
2:02the flag challenges and we thought, you
2:04know, we'll self-host a Gitea instance,
2:06build out some of our own sort of
2:07internal infrastructure, and then we
2:10used Authentic. We were using Authentic
2:12Security to be able to oh, actually get
2:14our accounts logged in and kind of have
2:16that self-hosted and open source
2:18environment." So, I think you all are
2:20genuinely doing really cool, awesome
2:22stuff. You're totally forgiven for a new
2:24acronym.
2:26Well, it's it's really fun as an open
2:28core company because, you know, all of
2:30our sales conversations start with, "Oh,
2:31I used this in my home lab." I've had,
2:33you know, multiple Fortune 500 CISOs
2:36say, "Oh, yeah, I remember that name. I
2:38think I've been running that and and
2:39running some experiments." So, you know,
2:41we we want to encourage the community to
2:44make use of this free open source tool
2:46and get used to our platform. And, you
2:49know, eventually we hope that some of
2:50that turns into business for us as they
2:51need other compliance features and and
2:54you know, enterprise pieces that uh we
2:56tack on top of that, but, you know, we
2:58it's actually a pretty good split. I
3:00think a lot of open source open core
3:02companies have kind of a tough time uh
3:05walking that line sometimes. And not to
3:07say that it's always clear black and
3:09white, but what a home lab user needs
3:11versus what a company with multiple IDPs
3:13and auditors and so forth needs is
3:15usually pretty clear-cut for us. Well,
3:17if I may ask, do you have any sweet show
3:20and tell? Do you have any you might be
3:21willing to screen share? Could we see
3:23any bit of it in action? I think it'd be
3:24awesome to uh dig under the hood.
3:26>> So, an identity provider by itself, you
3:28know, isn't all always the sexiest thing
3:31to to look at configuring and so forth.
3:33It just does what it needs to do. Not to
3:34say, you know, it is a a pretty sweet
3:36platform. We won't get through all of
3:38that in just a few minutes, but maybe
3:40just a highlight and we can can show
3:42really what sets it apart in terms of I
3:44was mentioning that flexibility and and
3:47automation and so forth. So, and I'll
3:49just bump over here not to to highlight
3:52our pricing, but to show again, you
3:53know, for folks just looking to check
3:55this out. This is a full-fledged
3:57identity provider. We have, you know,
3:58millions of installations that we find
4:00out every week, uh, you know, whether
4:02it's an individual home labber who comes
4:04up to us at Def Con and says, "I've been
4:06running this for my my home group." Uh,
4:09or, you know, a a university or, uh, you
4:12know, an IT consultancy, things like
4:14that. That they're running this in
4:15production as well. So, we welcome folks
4:17to do that. I could also poke around
4:18some of the, you know, more enterprise
4:20features, if we're interested. Um,
4:22again, that might be you have multiple
4:24IDPs or you have some auditing,
4:26compliance. We actually have our own
4:28custom Python build, uh, for FedRamp
4:31customers. So, uh, if you need FIPS
4:33compliance, again, it's much easier to
4:35do that within your own already audited
4:38infrastructure than it is to do, you
4:39know, as a a service, uh, reaching out
4:41to us and then trusting us with your
4:43data. So, let me go out to an example
4:45here. You know, obviously, this could be
4:47already very customized. I'm going to
4:49log in as a user. I'm going to log in,
4:50uh, just internally, uh, here, but this
4:53could be various stages where you you
4:55link someone out to a different brand, a
4:57different company portal. Maybe for
4:59certain users, you give them a UBIKey
5:01requirements or or not, depending on
5:03even location. You know, things like
5:05that are all very dynamic within
5:07Authentic. This is just a small test
5:09instance, but so you would see, you
5:10know, groups of my applications as a
5:12standard user dashboard. But, if I go
5:15over to the admin interface, this is
5:17where a lot of the magic happens. Again,
5:19I won't go through every last little
5:21detail here. This isn't a full product
5:24tour, but you can imagine all the
5:25standard, you know, our back, setting
5:27up, uh, applications, providers,
5:29sources, etc. On the endpoint side, this
5:32is more recent and current development
5:34for us, but, you know, we're not trying
5:36to be a full MDM, but for instance, you
5:38can log into your Windows machine
5:40locally at the same time as Authentic
5:42using your Authentic credentials. So,
5:44that's one fewer hop, one fewer thing to
5:47secure. We're looking at this for OS X
5:50and for Linux as well, like a PAM
5:51integration. Already supports SSF for
5:54for Apple Business Manager and School
5:56Manager. So, things like that are
5:57already very very tightly integrated
6:00with Authentic. Everything on the back
6:02end, it's essentially a Django project.
6:04And so, everything is an API. You have
6:06access to to everything that way as
6:08well. And that's another big sticking
6:10point that we see with a lot of folks
6:12where
6:13they end up writing a lot of duct tape
6:14on top of an Okta or Ping or something
6:17like that where, you know, it's kind of
6:19up to the product roadmap that's
6:22somewhat opaque to you, whether or not
6:25you get access to that attribute or that
6:27endpoint. And likewise, even if you do,
6:29you might start hitting some rate limits
6:30there. So, everything, you know, we have
6:33Terraform provider, etc. We we want you
6:35to automate this. We want you to have
6:37access to this. What reminded me there
6:38was the logs, you know, you can
6:39obviously just port that out to your SIM
6:42or whatever else. And you know, it's
6:44it's all your data. None of that gets
6:46gets sent back to us. So, this could
6:47also be run air-gapped even.
6:50And is in some some federal environments
6:52as well. In terms of customizations, one
6:54thing to mention here, you know, we have
6:56a lot of templates for seeing defaults
6:59and common actions and so forth. But
7:01everything gets
7:02decided essentially based on policies.
7:05So, you could see some common types of
7:08policies here. You know, what Okta might
7:10call sort of impossible travel. They
7:12decide for you, does it look like
7:14someone logged in halfway across the
7:15world in the same day? They'll flag that
7:17and decide what to do with that. That
7:20kind of works sometimes. But you know,
7:22if you really want to use that
7:24dynamically for specific groups, you
7:26know, I expect this group to be on a VPN
7:28or not.
7:29Or I expect, you know, some more
7:31alerting based on
7:33folks who are also accessing these
7:34applications, that sort of thing.
7:36You can customize all of this very
7:38dynamically. The most dynamic is an
7:40expression policy. So, I mentioned it's
7:43all Python. You know, this is
7:44essentially embedded Python within your
7:47policies. So, you don't need to go
7:48modify our code, but you can literally
7:51include Python here and reach in to
7:54those attributes. If you have your own
7:56custom attributes,
7:58you know, we could say like get
8:00something from the request context. I
8:03don't, you know, take my my uh
8:05This might not be exactly correct, but
8:07let's see live coding a bit. We can say
8:10username is something like that
8:14and lock them out.
8:16Um I don't know why you do that, but you
8:18know,
8:18um just as an example of this is very
8:21flexible. If you have something where,
8:23you know, you are tying back to multiple
8:25identity providers. We have a lot of
8:27folks who sort of have IT and
8:29infrastructure sprawl after a while. You
8:31could also use property mappings in
8:32order to, you know, tie to those other
8:35systems. And if you have certain
8:37attributes there that need to get
8:38mapped, we can either be that source of
8:40truth or that sort of glue and and go
8:42between uh in that way. Man, Fletcher,
8:45this is too cool. Like I I don't know. I
8:48I love the fact it super clear to me
8:51that like look, this is developer
8:52friendly. This is engineer friendly.
8:54Like you want to if you want to dig into
8:56code, you can. Python super flexible,
8:59always there for you. But even just the
9:01presentation interface management, like
9:03I know it it's easy for I don't want to
9:07say the big boy players, right? But uh
9:09yeah, sure, Octa and Entra, whatever.
9:12They are
9:13Again, I can't say bigger bloated, but
9:15overwhelming, right? Like there is so
9:17many different dials to turn and knobs
9:19and here and there, but this is just
9:21feels clean.
9:22Yeah. Yeah, yeah. I I think our stance
9:24overall is we don't want you to have to
9:26write code, but if you want to, we want
9:28you to look to go as deep as possible.
9:30So, I pulled up our our flows as an
9:32example here. You get, you know, a
9:34default common flow for this kind of
9:37application authorization and you can
9:39even see visually what should happen
9:40there. But again, if you need to embed
9:42code in there or go farther and and
9:45really customize something, you can do
9:47that as well. So, giving folks the the
9:49power to really dive in
9:52whatever level is is necessary to to get
9:54the job done without having to tack on
9:56their own services or wait for us to do
9:58something as well. Yeah, I think the
10:01fact that we've built this up with very
10:03clear building blocks. I'll say that
10:05some competitors may have a longer list
10:08of you know, a catalog of integrations
10:10pre-built.
10:11But what we found is even if it's not
10:13pre-built within authentic, we can help
10:15you build that within a day or two much
10:17more easily and inevitably things get
10:20out of date, they start breaking,
10:21they're not using the latest
10:24you know, attribute that's allowed there
10:26or something like that. It is so much
10:28easier to then go ahead and update that
10:30directly within this kind of
10:31configuration. A larger customer rollout
10:34Workday was an example of
10:37notoriously hairy integration
10:40that we didn't yet have, but we were
10:41able to build it with them for
10:44I think under a week sort of part-time
10:46effort and now that's also something
10:48that you know, we can put out in the
10:50catalog for all of our other customers
10:52as well. So, you know, the the stage has
10:54been set for something that can continue
10:57to grow and and evolve as needed with
10:59the extending technologies that
11:02seem to only be moving faster these
11:04days.
11:05Yeah, I didn't know if we wanted to open
11:06the can of worms for the whole AI
11:08agentic stuff, but
11:10it is good to still have you know, the
11:12guardrails in place where we want them.
11:15For sure. Yes, I mentioned B2B, B2C and
11:18service accounts.
11:20You know, we've we've supported service
11:21accounts for a long time. They now have
11:24taken on much more prominence and
11:25importance where you might need an agent
11:28who has an expiring token-based account
11:31uh is tied to a user and so forth. We
11:33don't see why that needs to be a
11:35separate system or separate set of
11:37functionality and capabilities.
11:39Eventually, all these agents are
11:41converging on
11:42being able to do all the same things
11:44that the human in the system can do.
11:45Further, why should that be some
11:48ever-changing GUI that the the agent has
11:51to point and click through and maybe
11:52work its way through versus an API is
11:55available to it for every single action.
11:57So, that's again points back to
11:59everything should be automatable.
12:00Everything should be accessible within
12:02the right guardrails uh to to every
12:05user. So, similarly, setting up roles
12:07and groups and permissioning for the
12:08service accounts as well as is just as
12:10important.
12:11>> Well, I have not yet dug on into things
12:13more for my own and our own internal
12:16like J H L O C authentic interface and
12:19the instance here, but now I got it.
12:21This is just too cool, my friend.
12:24What else are you up to? Are you heading
12:25off to, I don't know, the big RSA? What
12:27else is on your world? New blog posts,
12:29new releases? What's upcoming?
12:31>> I will be at RSA, unfortunately. Uh
12:35so, we work with Decibel who has the
12:36Oasis, uh which is actually the
12:38Children's Museum next to all of the the
12:42RSA happenings, which has has good
12:44vibes. So, I'd welcome folks to come
12:47check that out. Uh we also have a few
12:49folks speaking, myself and a couple
12:51teammates at B-Sides beforehand.
12:53>> Excellent. Um so, we're we're uh excited
12:56to engage with the community, talk about
12:58building an open source open core
12:59company and product and security product
13:02specifically. We were out at Def Con
13:04this year with a booth, which was a a an
13:07entertaining adventure. I've been going
13:08there for years, but my first time uh in
13:11a a corporate role. Um but, it was
13:13really fun, just the variety people
13:14coming to us and talking about their
13:17their usage of authentic throughout the
13:19years. So, really fun to see, and
13:21hopefully we'll see some folks out there
13:23in in San Francisco as well. Absolutely.
13:26Well, I think honestly the call to
13:27action is pretty easy because you've got
13:29this open source and free. It's really
13:31just a matter of go to the website,
13:32check out Authentic, and get it up and
13:34run it, right?
13:35For sure. Go authentic.io or you can
13:38find our our GitHub pretty easily.
13:40Um you don't have to sign up for
13:42anything. Just download it. It's a an
13:44easy Docker Compose and try things out.
13:46Well, I'll get some of those links in
13:48the video description here in the
13:49caption below the post here. But thank
13:51you. Thank you. Thank you, Fletcher.
13:53Genuinely, this is super cool. I'm so
13:55excited to see where you keep cruising
13:56with this thing. Thanks again.
13:58Thanks so much, Joe.