deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Join us this October as we celebrate Hacktoberfest 2024 by encouraging developers to contribute to the open-source community.

We are excited to announce our inaugural [Authtoberfest 2024](https://authtoberfest.io/)!

![Authtoberfest 2024](https://images.ctfassets.net/23aumh6u8s0i/XGONROR1fr5aabZYKtkDC/3ef4d233bfbb1e79dcb1fcf755af2bb6/authtoberfest-logo.jpg)

Are you ready for Hacktoberfest? We are excited to participate in [Hacktoberfest 2024](https://hacktoberfest.com/), and we are calling all developers to join us in contributing to the open-source community.

Whether you're new to open source or an experienced contributor, this is your chance to give back, make a difference, and win some cool swag in the process.

At Auth0 by Okta, we believe in the power of community-driven development and open source. That’s why we’re proud to support and celebrate Hacktoberfest and help developers of all levels get involved. Let's code, collaborate, and contribute together!

![Authtoberfest 2024 T-shirt](https://images.ctfassets.net/23aumh6u8s0i/1PWpoxpdJtgsFDs9vx8jJL/118ee5e900b1653da2566238f8b2f60e/t-shirt-image.jpg)

This year, you have the chance to win a cool limited-edition T-shirt from us when you participate in Hacktoberfest and contribute to any of the projects in the Identity and Security space shortlisted by us. The first 100 valid submissions will get the T-shirt.

> A GitHub user with two accepted/merged PRs sending us the confirmation emails and the Hacktoberfest badge will be considered a valid submission.

Visit the [Authtoberfest website](https://authtoberfest.io/) to learn more about the event and how you can participate.

Authtoberfest 2024 is Here!

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

How Open-Sourced Akto Uses Auth0 to Secure APIs

The security startup, [Akto](https://www.akto.io/), allows users to discover, test, and find API vulnerabilities in a minute. Security and engineering teams can evaluate their APIs utilizing the [Akto platform](https://docs.akto.io/readme) by taking API inventory, testing and finding business logic vulnerabilities, and monitoring issues in run-time. With 30 million developers using APIs every day, the Akto team discovered an opportunity to address the constant addition and modification of APIs and protect their customers from harmful data leaks. 


<include src="QuoteCard" body="API security is where people are lagging. There is no place to get your API inventory, and there’s no place to do API testing in an automated way." name="Ankita Gupta" title="CEO & Co-Founder" team="" company="Akto" />


In our sit-down with the team, [Ankita Gupta](https://www.linkedin.com/in/ankita-gupta-89214515), CEO and Co-founder, shared more about Akto’s product-led growth model that helps their customers jump into the platform and start for free in a minute. “From day one, we wanted to make it a product-led product. Early on, we realized that it’s more of a security engineer problem than a CISO problem, so we needed a bottom-up model.” (Fun fact: Auth0 also offers a product-led growth model that helps our customers get started immediately. We are always delighted to hear when other companies are doing the same!) 

Ankita shared more about Akto’s decision to [open source](https://www.akto.io/blog/introducing-akto-open-source) and everything they’ve developed so far. The team saw that their customers wanted to contribute, add custom tests, or add custom rules for their business case, so open source made sense. Once the results were in, they were met with customer praise and felt customers were more comfortable with customization. The Akto team strongly believes that open sourcing will help developers and security teams around the world secure their application APIs from attacks. [Ankush Jain](https://www.linkedin.com/in/ankushgjain?trk=public_post_share-update_actor-text), Co-Founder and CTO, shared, “We are building the platform by being transparent to the security community and getting the community’s help in building the product.” 

## Letting Auth0 Take Care of the Login Box

When the Akto team was building their product, they knew that login flow was one of the biggest problems they or any startup will have, but they didn’t want to build it themselves. “It’s been a very smooth journey for us; we don’t have to think of anything around login now,” said Ankita. They use Auth0 for their primary login page, where customers can sign up and start their onboarding journey. A few features that make this possible and frictionless are [email verification](https://auth0.com/docs/manage-users/user-accounts/verify-emails), [Social Login](https://auth0.com/learn/social-login), and [password recovery](https://auth0.com/learn/password-reset). They also built a custom login in-house, but compared to their Auth0 login flow, they saw reliability issues, especially with fake emails. With Auth0, they were not only able to streamline their customer onboarding experience but also receive accurate data for their business. 

![Checklist](https://images.ctfassets.net/23aumh6u8s0i/6TXxpAfYPc1XwopbYH5Mx8/132e780e64563d54464cd3af0884047f/Akto_Checklist_-1.png)

## Join Akto and the other 1700+ startups that benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/53). 

A special thank you to Ankita, Ankush, and the entire Akto team. If your organization wants to secure your APIs in a minute, [get started](https://github.com/akto-api-security/akto) today. 

_This profile is the second installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._


Startup Stories: Akto

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Fine grained authorization-at-scale, available for everyone

[A few months ago](https://auth0.com/blog/auth0-fine-grained-authorization-developer-community-preview-release/) we announced a Developer Preview of Auth0 Fine Grained Authorization (FGA), our upcoming SaaS product to solve authorization-at-scale for developers. Today we’re announcing [OpenFGA](https://openfga.dev/), the open-source engine that powers Auth0 FGA.

OpenFGA is a fast, flexible Fine-Grained Authorization System inspired by [Google's Zanzibar](https://research.google/pubs/pub48190/) paper, and has been designed for reliability and low latency at a high scale. It makes it easy for application developers to model their access control layer, and to add and integrate fine-grained authorization in a way that is consistent across all of their applications. It’s designed, built, and sponsored by Okta/Auth0.

## Why Is Fine-Grained Authorization Important?

Modern applications have evolved in a way that end-users now drive permission management. This makes fine-grained authorization an increasingly critical element in software. For example:

**Collaboration** and **Social** features are things users expect. These features range from the **‘Share’** button where users proactively grant specific permissions to a set of users for a specific resource, to **‘Request Access’** workflows that allow users to reactively grant access on demand. These features are useful both for business-related assets such as documents or project boards, as well as social sharing personal content like photo albums, social media posts, and even IoT devices.

**Security, compliance and privacy** are mandatory problems to solve for any software application from day one, and authorization is a big part of any solution. In fact, the top [2021 OWASP risk is broken access control.](https://owasp.org/Top10/)

Organizations like Airbnb and Carta have built Zanzibar-like systems to solve their authorization needs. We don’t think organizations should have to keep building the same authorization tools, again and again, so we set out to build one version that any developer can use. 

## How Does It Work?

As an example, we’ll use OpenFGA to model a simple expense management system. Imagine expense reports have the following requirements:

* Can be submitted by any employee.
* Can be approved by the submitter’s manager, or by the manager’s manager (or their manager, etc..).
* Can be viewed by the submitter, the approver, and anyone else that got the report shared with them.

To solve this problem in OpenFGA you would define the following authorization model:

```go
// There are reports in the system
type report
 relations
   // Reports have submitters (user who have submitted that report)
  define submitter as self
   // Reports have approvers (users who can approve reports)
   // A report's approvers are the managers of the submitter
   // of that report
  define approver as manager from submitter
   // Reports have viewers (user who can view that report)
   // The users who can view a report are the submitter,
   // the users who can approve it, anyone it has been shared directly with
  define viewer as self or submitter or approver

// There are employees in the system
type employee
 relations
   // Employees have managers, managers are those directly assigned
   // or anyone who's a manager of a manager
  define manager as self or manager from manager
```

The OpenFGA language uses `self` to indicate that the relationship can be assigned.

* Submitters and viewers of a report can be directly assigned.
* Direct managers of an employee can be directly assigned.

Definitions without `self` can not be assigned directly but can be inherited.

In addition to defining an authorization model, OpenFGA requires you to provide the actual data to instantiate these permissions. In this example, we’ll have 4 participants:

* Daniel, who is Sam’s manager
* Matt, who is Daniel’s manager
* Sam, who will submit an expense report
* Peter, who works in the same team as Sam. Sam wants to share the report with him.

You would provide this data by using the [OpenFGA’s Write API](http://openfga.dev/api/service/#/Tuples/Write) and a few “tuples”. 

Some of the tuples will define the direct reports. This data will probably be synchronized automatically from an HR system (e.g. Workday):

```json
{ 
    "user": "employee:daniel",  
    "relation": "manager", 
    "object": "employee:sam" 
}
```

```json
{ 
    "user": "employee:matt",  
    "relation": "manager", 
    "object": "employee:daniel" 
}
```

Whenever Sam submits an expense report (in this example, ‘sam-trip’), the following tuple should be created:

```json
{ 
    "user": "employee:sam",  
    "relation": "submitter", 
    "object": "report:sam-trip" 
}
```

When Sam later shares the report with Peter, the following tuple should be created:

```json
{ 
    "user": "employee:peter",  
    "relation": "viewer", 
    "object": "report:sam-trip" 
}
```

With the above information now in the system, we can now ask OpenFGA if a specific user has a specific relation with a particular object. We do that by using [OpenFGA’s Check API,](https://openfga.dev/api/service#/Tuples/Check) which will return true or false. For example, if we check:

```json
{ 
    "user": "employee:matt",  
    "relation": "approver", 
    "object": "report:sam-trip" 
}
```

OpenFGA will return **TRUE**, as Matt is the manager of Sam’s manager, and Sam is the submitter of the expense report.

You can also use the [‘Expand’ API](https://openfga.dev/api/service#/Relationship%20Queries/Expand) to understand why OpenFGA returns that result. The Auth0 FGA Playground provides a visualization of the results of calling that API:

![OpenFGA](https://images.ctfassets.net/23aumh6u8s0i/1eSifra3BxJLVtV6XtR4xv/58c1a82f8770c9a2555b9632dbc80507/OpenFGA.jpg)

It needs to answer “is `employee:matt` related to `report:sam-trip` as approver”. To do that, OpenFGA:

1. Expands the “approver” relationship for Sam’s report
2. Finds out that the approver needs to be Sam's manager (the report submitter’s manager), and finds out who the managers are <br>
    **a**. Daniel is Sam’s assigned manager, but Daniel is not the one we are looking for <br>
    **b**. Daniel's managers are also Sam's managers, so OpenFGA needs to expand them <br>
3. Expands the “manager” relationship for Daniel <br>
    **a**. Matt is Daniel's manager, which is what we were looking for! <br>
    **b**. Matt's managers would also be Sam's managers, but there's no manager defined for Matt <br>

To summarize, you need to:

* Define a domain-specific authorization model.
* Use the `Write()` API to add relationship tuples.
* Use the `Check()` API to check for permissions.
* Use the `Expand()` API in cases where you need a detailed understanding of the `Check()` results instead of a simple `TRUE` or `FALSE` response

## Why Open Source?

Both Auth0 and Okta maintain a large number of open source projects and use a myriad of open source products internally. This time we are going one step further than usual and open-sourcing a core Auth0 product. We’ll continue to offer [Auth0 FGA](https://fga.dev/) as a SaaS offering, but also strive to build the best open source implementation of a Zanzibar-style authorization system.

We’re doing this for several reasons:

* We believe there’s an opportunity to create a large ecosystem around a fine-grained authorization system, and that making our FGA offering open source will maximize the chances for this to happen. We expect OpenFGA integrations for authorization policies products like [OPA](https://www.openpolicyagent.org/), proxies like [Envoy](https://www.envoyproxy.io/), API gateways like [Kong](https://konghq.com/); identity providers ([Auth0](https://auth0.com/es), [Okta](https://www.okta.com/), [AzureAD](https://azure.microsoft.com/es-es/services/active-directory/)), SDKs for platforms and frameworks (Python, Java, [Spring](https://spring.io/), [Next.js](https://nextjs.org/)), etc. 
* We want to enable customers that require deploying in different cloud providers,  on-premise, in multiple regions, with FedRAMP compliance, or those that have a low tolerance to the risk of delegating authorization to a third party provider. From our experience with Auth0, we know those are difficult problems for a SaaS product.
* The industry will benefit by having a common way to manage Fine Grained Authorization. We believe Auth0/Okta is the company that can make this happen. It’s a leader in the Identity Access Management space, is trusted by thousands of customers, is cloud-agnostic, and has the financial capacity to invest in the product long-term.

## What Are We Open Sourcing?

We are open sourcing the engine that drives our SaaS product, and the SDKs that make it so easy to use. 

You can find all of these projects hosted in an [OpenFGA organization on Github.](https://github.com/openfga)

* [OpenFGA Server](https://github.com/openfga/openfga): the core FGA server which provides:
   * An expressive language to define your authorization model.
   * HTTP APIs for checking and granting permission, authoring models, query tuples.
   * A graph querying implementation inspired by Google Zanzibar
   * Pluggable storage adapters, with support for an in-memory database and PostgreSQL
   * OpenTelemetry tracing, metrics, and structured logging
* [Website and Docs](https://github.com/openfga/openfga.dev): The openfga.dev website, which includes our product documentation.
* [SDK Generator](https://github.com/openfga/sdk-generator): Tooling to generate SDKs based on OpenAPI definitions.
* [Go SDK](https://github.com/openfga/go-sdk), [.NET SDK](https://github.com/openfga/dotnet-sdk), [Javascript SDK](https://github.com/openfga/js-sdk): SDKs for different languages, with more to come soon!
* [Auth0’s FGA Playground](https://play.fga.dev/), which is not open source now but it will be in the following weeks.

## OpenFGA and the Cloud Native Computing Foundation

The Cloud Native Computing Foundation (CNCF) is an open-source software foundation that promotes the adoption of cloud-native computing. It hosts projects like Kubernetes, Envoy, and Open Policy Agent, along with a hundred others.

As we mentioned earlier, we believe there needs to be an open source version of a Zanzibar-inspired Fine Grained Authorization product. Creating such a product requires an initiative that early adopters can trust. To further accelerate this process, **we submitted OpenFGA to the Cloud Native Computing Foundation sandbox**. 

By joining the CNCF, the OpenFGA project will find a larger, vibrant community that will help this initiative to continue growing and attract more users and developers.

## Try It!

An open source project is only as good as its community, so we are extending a warm welcome to everyone that wants to get involved.

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our bi-monthly office hours, or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project. 

Find out more by visiting [openfga.dev](https://openfga.dev/), and learn how to use it in our [awesome documentation](http://openfga.dev/docs). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).

Announcing OpenFGA - Auth0’s Open Source Fine Grained Authorization System

ryan cobb

As a patent attorney, I thoroughly enjoy providing counsel relating to the intersection between technology and law. In my current role as the IP counsel for Okta, I advise the company on a all IP matters (including supporting various roles including product, employment, M&A, Okta Ventures, and commercial legal) and help create and manage policies and workflows to enable the business and engineering teams to succeed in the marketplace.

Director, IP Counsel

Ryan Cobb

Developers contributing to Auth0 and Okta projects are provided with a simple way to complete our industry-standard agreement in just a few clicks

We’re going to soon be implementing a Contributor License Agreement (CLA for short) on our open source projects to allow us to continue providing as many open source offerings as we can. 

What’s a CLA, you may be asking? Well, in short, it provides licenses to us and the rest of the community to use the Intellectual Property (IP) you create when you contribute to one or more of our open source projects. But more on the nuts and bolts of that later… 

Why are we doing a CLA now? As we grow, we increasingly see a need to protect our open-source projects at Auth0 and Okta so that we can freely accept contributions and our projects can grow. Additionally, the CLA process at Okta was cumbersome, and we wanted to relax that, so we decided to use CLA Assistant to streamline the signing process for our fantastic community of contributors. 

To create our CLA, we looked around the industry and based our CLA on similar language found in those from the [Apache Foundation](https://www.apache.org/licenses/icla.pdf), [.NET Foundation](https://github.com/dotnet-foundation/foundation/blob/master/guidance/net-foundation-contribution-license-agreement.pdf), [CNCF](https://github.com/cncf/cla/blob/master/individual-cla.pdf), [Google](https://cla.developers.google.com/about/google-individual?csw=1), the [Eclipse Foundation](https://eclipse.org/legal/ECA.php), and [Salesforce](https://cla.salesforce.com/sign-cla), to name a few. You can check out the text of our CLA [here](https://cdn.auth0.com/blog/okta_cla.pdf). If you’ve signed a CLA with Okta in the past, we’re going to ask you to sign a new one via the CLA Assistant (don’t worry… you don’t need to print anything out… you just sign right in Github!). This way, we have all the agreements in the same place and organized by your Github handle. It’s just a few clicks! 

If you want to contribute to one or more of our Open Source projects, what it means to you is: 

* License grant - you grant a copyright and patent license to your contribution so that others using the open-source project can use it without fear of infringement issues. 
* We ask that you represent that the contributions are yours to be made, and you can grant the associated rights to those contributions. 
* We don’t expect you to provide any support for your work unless you want to. 
* The agreement is retroactive to cover your past contributions to ensure we have the most up-to-date protections. 
* Suppose you’ve made contributions in the past but don’t want to sign our CLA, no problem. You don’t need to sign it for any of your past work. But, if you want to make contributions from now on, we will ask you to sign the CLA so that we can make sure we continue offering our best to the community. 

We hope these changes will make the experience of contributing to our Open Source projects better, more straightforward, and safer for everyone. If you have any questions or concerns on this, please reach out to our developer forum, where we will do our best to get you the answers and address your needs. Thank you for your past and future contributions! We appreciate them and look forward to continuing building together!

<include src="asides/AboutAuth0" />

Scaling Our Open Source Projects: Implementing a Contributor License Agreement

joyce-echessa

Guest Author

Joyce Echessa

Learn how to integrate the Realm mobile database in an Android application.

Integrating Realm Database in an Android Application

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Auth0 provides global community of 30 million developers, educators, and businesses with simple, secure identity management


**LONDON - July 29, 2019 -** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as the identity management platform of choice for Arduino®, the world's leading open-source hardware and software ecosystem. With a global community of 30 million "makers", [Arduino](https://www.arduino.cc/) will use Auth0 to replace its own Single Sign On solution for all of its public facing web properties, including Arduino Create and community apps.

Arduino is on a mission to enable anyone to innovate by making complex technology simple to use. Its simple and accessible electronic boards, open-source software, and user community have powered thousands of projects, [from everyday objects to complex scientific instruments](https://create.arduino.cc/projecthub). Educational institutions around the world also use Arduino as a resource for STEAM programmes &ndash; integrating Science, Technology, Engineering, Arts, and Math.

Arduino discovered its homegrown authentication solution would not scale to meet the rapidly developing needs of its growing global community, and reached out to Auth0. In addition to Single Sign On, Arduino will take advantage of Auth0's new [Universal Login](https://auth0.com/docs/universal-login), which enables developers to completely customise their branded authentication experiences quickly, and [Device Flow](https://auth0.com/device-flow/) for browserless or input-constrained devices.

"We wanted a robust platform to replace our SSO solution but also give us the flexibility to do cool, new things in the device authentication space. Auth0 is a brand we admire, and their API-based approach makes it easy to migrate our login data in a way that's completely transparent for the customer," said Gianluca Varisco, CISO at Arduino. "We are excited to welcome them to our global community."

Auth0 and Arduino plan to leverage the combined power of their communities and events, and explore a technical partnership in the IoT domain. Auth0 currently secures more than 2.5 billion logins per month for 21 million users.

"I have been using Arduino for years as the brain for my personal projects, so working with them in a business capacity is really rewarding," said Eugenio Pace, CEO and co-founder of Auth0. "When you empower the developer with simple, powerful tools, the whole business benefits. We are excited by the reach of the Arduino community and aligned in our mission to help the developer in their journey to innovate."

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113


Arduino Selects Auth0 as Standardized Login for Open-Source Ecosystem

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Our 10 most-popular developer posts in 2018 ranging from front-end development to open source contributions.



Time flies when you are having fun. It's December already and we are getting ready to wrap up this year. 2018 was a prolific year for the Auth0 blog: we published more than 200 posts (😱) where we tackled a diverse amount of topics: frontend and backend technologies, data breaches, GDPR, Cybersecurity, Company Culture, and of course, Identity.

We believe looking back is key to look ahead. That is why this week, we are going to take a look back at the best and most impactful posts we have published in 2018.

One article wouldn't be enough to review this amazing year, that's why we have decided to split this year in review into 3 parts: Developer Posts, [Security Posts](https://auth0.com/blog/10-most-popular-security-posts-in-2018/), and [Identity Posts](https://auth0.com/blog/10-most-popular-identity-posts-in-2018/).

Without much further ado, here's the roundup of our 10 most-popular developer posts this year!

![Auth0's 10 Most-Popular Developer Posts](https://images.ctfassets.net/23aumh6u8s0i/6d6NAZbouw2Vm6KKuUxGkp/332d039ec84578561690ab2702ec30bf/auth0-blog-best-of-2018-developer-posts)

## <a name="Auth0s10Most-PopularDeveloperPostsin2018-How-tosTutorialsandMor"></a>Auth0's 10 Most-Popular Developer Posts in 2018 - How-to's, Tutorials, and More

> The following posts are not listed in any particular order.

1. <a href="#TheCompleteGuideToDeployingJavaScriptApplications-Part1" target="_self">The Complete Guide To Deploying JavaScript Applications - Part 1: Database, and API Deployment</a>
2. <a href="#ReactiveProgramminginPythonhttps" target="_self">Reactive Programming in Python</a>
3. <a href="#ReactTutorial" target="_self">React Tutorial: Building and Securing Your First App</a>
4. <a href="#DevelopingWebAppswithASP.NETCore2.0andReact-Part1https" target="_self">Developing Web Apps with ASP.NET Core 2.0 and React - Part 1</a>
5. <a href="#UsingPythonFlaskandAngulartoBuildModernWebApps-Part1https" target="_self">Using Python, Flask, and Angular to Build Modern Web Apps - Part 1</a>
6. <a href="#Vue.jsKanbanBoard" target="_self">Vue.js Kanban Board: The Development Process</a>
7. <a href="#BestPracticesinAndroidDevelopmenthttps" target="_self">Best Practices in Android Development</a>
8. <a href="#Real-TimeChartsusingAngularD3andSocket.IOhttps" target="_self">Real-Time Charts using Angular, D3, and Socket.IO</a>
9. <a href="#DevelopingReal-TimeWebApplicationswithServer-SentEventshttps" target="_self">Developing Real-Time Web Applications with Server-Sent Events</a>
10. <a href="#AFirstTimersGuidetoanOpenSourceProjecthttps" target="_self">A First Timers Guide to an Open Source Project</a>

## <a name="TheCompleteGuideToDeployingJavaScriptApplications-Part1"></a>1. [The Complete Guide To Deploying JavaScript Applications - Part 1: Database, and API Deployment](https://auth0.com/blog/the-complete-guide-to-deploying-javascript-applications-part-1/)

Atwood's law states that _Any application that can be written in JavaScript, will eventually be written in JavaScript._ In 2018, eleven years after this law was proposed, JavaScript is now the most popular language in the world. In this tutorial, you'll learn how to deploy your JavaScript applications to different cloud platforms such as Google Cloud, Microsoft Azure, Netlify, and others.

<AmpContent>
<a href="https://auth0.com/blog/the-complete-guide-to-deploying-javascript-applications-part-1/">
  <amp-img width="1.5" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/53GC5Ijur7QUmJR6wFiEOr/168205ab0c6003fa00829e1155e70236/awscreatetable" alt="Amazon DynamoDB"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/the-complete-guide-to-deploying-javascript-applications-part-1/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/jsdeploy/awscreatetable.png" alt="Amazon DynamoDB"/>
  </a>
</div>

</NonAmpContent>

## <a name="ReactiveProgramminginPythonhttps"></a>2. [Reactive Programming in Python](https://auth0.com/blog/reactive-programming-in-python/)

In this tutorial, you’ll be learning how to use the RxPy library to create asynchronous and event-based programs by implementing observables, observers/subscribers, and subjects. You will start by getting our data stream from the GitHub API with a Tornado web socket and then you will filter and process it asynchronously. [In this GitHub repository](https://github.com/valerybriz/RxGithubSearcher), you can find the code that we are going to create in this tutorial.

<AmpContent>
<a href="https://auth0.com/blog/reactive-programming-in-python/">
  <amp-img width="1.5" height="0.7" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/4nxuqP7IqV1gHEsO9abqjL/9a49e46dab847b8f010d9b3ed92d0609/combine-latest" alt="RxPy combineLatest marble diagram"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/reactive-programming-in-python/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/10-most-read-technical-articles-in-2018/combine-latest.png" alt="RxPy combineLatest marble diagram"/>
  </a>
</div>

</NonAmpContent>

## <a name="ReactTutorial"></a>3. [React Tutorial: Building and Securing Your First App](https://auth0.com/blog/react-tutorial-building-and-securing-your-first-app/)

In this article, you will learn the basic concepts of React. After that, you will have the chance to see React in action while creating a simple Q&A (Questions & Answers) app that relies on a backend API. If needed, you can check [this GitHub repository to check the code that supports this article](https://github.com/auth0-blog/react-tutorial). Have fun!

<AmpContent>
<a href="https://auth0.com/blog/react-tutorial-building-and-securing-your-first-app/">
  <amp-img width="1.5" height="0.95" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/SMBzTsEDRhGQGjRdfOXat/abf9d57a0f2163d77c95c30aaaf0204c/q-and-a-app" alt="React Q&A app"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/react-tutorial-building-and-securing-your-first-app/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/react-tutorial/q-and-a-app.png" alt="React Q&A app"/>
  </a>
</div>

</NonAmpContent>

## <a name="DevelopingWebAppswithASP.NETCore2.0andReact-Part1https"></a>4. [Developing Web Apps with ASP.NET Core 2.0 and React - Part 1](https://auth0.com/blog/developing-web-apps-with-asp-dot-net-core-2-dot-0-and-react-part-1/)

In this series of posts, you will build a Web application based on ASP.NET Core 2.0 and React. To solve the identity management feature, you will integrate this stack with [Auth0](https://auth0.com/). In this first part of the series, you are going to use ASP.NET Core 2.0 to develop the APIs of your application. [The final code can be found in this GitHub repository](https://github.com/andychiare/netcore2-auth0).

<AmpContent>
<a href="https://auth0.com/blog/developing-web-apps-with-asp-dot-net-core-2-dot-0-and-react-part-1/">
  <amp-img width="1.5" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/3VdEYdUZjg1dZ8CjKW7FFy/e6dacc131f59c2ab0459cb72a6addb6a/creating-project" alt="Creating an ASP.NET Core Web App with Visual Studio"> </amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/developing-web-apps-with-asp-dot-net-core-2-dot-0-and-react-part-1/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/dotnet-core-react/creating-project.png" alt="Creating an ASP.NET Core Web App with Visual Studio"/>
  </a>
</div>

</NonAmpContent>

## <a name="UsingPythonFlaskandAngulartoBuildModernWebApps-Part1https"></a>5. [Using Python, Flask, and Angular to Build Modern Web Apps - Part 1](https://auth0.com/blog/using-python-flask-and-angular-to-build-modern-apps-part-1/)

In this series, you will learn how to create modern web applications with Python, Flask, and Angular. You will use this stack to build a single-page application (SPA) and a backend API to expose exams and questions so users can test their knowledge regarding different technologies. [In this GitHub repository](https://github.com/auth0-blog/python-flask-angular-1), you can find the final code created throughout the first part of the series.

<AmpContent>
<a href="https://auth0.com/blog/using-python-flask-and-angular-to-build-modern-apps-part-1/">
  <amp-img width="1.5" height="0.75" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/1IfSLdFZd6LkXpiDgD6GWX/30ef9e44980a5b9fd549b8115db508d3/fetching-data" alt="Using Angular to fetch data from a Flask application"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/using-python-flask-and-angular-to-build-modern-apps-part-1/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/flask-angular/fetching-data.png" alt="Using Angular to fetch data from a Flask application"/>
  </a>
</div>

</NonAmpContent>

## <a name="Vue.jsKanbanBoard"></a>6. [Vue.js Kanban Board: The Development Process](https://auth0.com/blog/vuejs-kanban-board-the-development-process/)

In this article, you will use Vue.js (the progressive
JavaScript framework) to build an interactive Kanban board in the browser. The complete source code for [this project is available on a GitHub repository](https://github.com/elkdanger/kanban-board) and [there is a demo available online](https://kanban.elkdanger.co.uk) of the finished project.

<AmpContent>
<a href="https://auth0.com/blog/vuejs-kanban-board-the-development-process/">
  <amp-img width="2" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/34JnBo0Yc1RwsWU3fPhGgy/68881fae75371f2ef43ba9cf3b6913ac/new-item-component" alt="Kanban board preview"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/vuejs-kanban-board-the-development-process/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/vuejs-kanban/new-item-component.png" alt="Kanban board preview"/>
  </a>
</div>

</NonAmpContent>

## <a name="BestPracticesinAndroidDevelopmenthttps"></a>7. [Best Practices in Android Development](https://auth0.com/blog/best-practices-in-android-development/)

Best practices are simply professional standards that are acceptable in a field. In this post, you will look at such practices as it relates to Android development.

<AmpContent>
<a href="https://auth0.com/blog/best-practices-in-android-development/">
  <amp-img width="1" height="0.96" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/xUNLk6pd2SlY3RpC03DxS/aea85be3d402071f014e2f1aa1149106/viewmodel-lifecycle" alt="The lifecycle of an Activity as compared to that of a ViewModel"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/best-practices-in-android-development/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/android-best-practices/viewmodel-lifecycle.png" alt="The lifecycle of an Activity as compared to that of a ViewModel"/>
  </a>
</div>

</NonAmpContent>

## <a name="Real-TimeChartsusingAngularD3andSocket.IOhttps"></a>8. [Real-Time Charts using Angular, D3, and Socket.IO](https://auth0.com/blog/real-time-charts-using-angular-d3-and-socket-io/)

Charts create some of the most catchy sections on any business applications. A chart that updates in real time is even more catchy/useful and adds huge value to users. Here, you will see how to create real-time charts using Angular, D3, and Socket.IO. You can find the final code produced throughout this article in [this GitHub repository](https://github.com/auth0-blog/angular-d3-socketio).

<AmpContent>
<a href="https://auth0.com/blog/real-time-charts-using-angular-d3-and-socket-io/">
  <amp-img width="1.6" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5KHFbR84G0MCW5LuWqjRkl/0eef204a5b72bb81cf017ed7c08766b2/d3-charts-with-static-data" alt="Showing a D3 chart with static data in an Angular application."></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/real-time-charts-using-angular-d3-and-socket-io/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/angular-d3-socketio/d3-charts-with-static-data.png" alt="Showing a D3 chart with static data in an Angular application."/>
  </a>
</div>

</NonAmpContent>

## <a name="DevelopingReal-TimeWebApplicationswithServer-SentEventshttps"></a>9. [Developing Real-Time Web Applications with Server-Sent Events](https://auth0.com/blog/developing-real-time-web-applications-with-server-sent-events/)

Server-Sent Events (SSE) is a standard that enables Web servers to push data in real time to clients. In this article, we will learn how to use this standard by building a flight timetable demo application with React and Node.js. However, the concepts you will learn following this tutorial are applicable to any programming language and technology. [You can find the final code of the application in this GitHub repository](https://github.com/andychiare/server-sent-events).

<AmpContent>
<a href="https://auth0.com/blog/developing-real-time-web-applications-with-server-sent-events/">
  <amp-img width="2.1" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/7MwSxNH2e21wVVivNZQZlk/4355791a943ddbaeaf02a8fd4a9bb9a9/developing-real-time-web-applications" alt="Real-time flights tracker timetable"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/developing-real-time-web-applications-with-server-sent-events/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/server-sent-events/developing-real-time-web-applications.png" alt="Real-time flights tracker timetable"/>
  </a>
</div>

</NonAmpContent>

## <a name="AFirstTimersGuidetoanOpenSourceProjecthttps"></a>10. [A First Timers Guide to an Open Source Project](https://auth0.com/blog/a-first-timers-guide-to-an-open-source-project/)

On open source in general, contributions by first-timers and code newbies are encouraged, because that is the essence of open source: Learning and collaboration, together, for the benefit of everyone. It can be scary and a little overwhelming the first time, but there are projects and [events like Hacktoberfest](https://auth0.com/blog/celebrate-hacktoberfest-with-auth0/) out there tailored to helping you to get involved and gain confidence in making your first contribution.

<AmpContent>
<a href="https://auth0.com/blog/a-first-timers-guide-to-an-open-source-project/">
  <amp-img width="1.86" height="1" layout="responsive" src="https://images.ctfassets.net/23aumh6u8s0i/2gqWE52GkPXd9SGFSNWjnC/95fd686c507fb7e58d3ce19975b68c87/step-2-github-generates-a-fork-repository-for-you" alt="GitHub will generate a copy of the repository"></amp-img>
</a>

</AmpContent>

<NonAmpContent>

<div class="clickable-image">
  <a href="https://auth0.com/blog/a-first-timers-guide-to-an-open-source-project/">
  <img class="no-lightbox" src="https://cdn.auth0.com/blog/a-first-timers-guide-to-an-open-source-project/step-2-github-generates-a-fork-repository-for-you.png" alt="GitHub will generate a copy of the repository"/>
  </a>
</div>

</NonAmpContent>

## <a name="WhatsNex"></a>What's Next?

We are already preparing our content pipeline for 2019. The world of technology keeps evolving very fast and it's our duty to keep our blog fresh and updated with all its upcoming trends and changes. We have a commitment to keep improving the quality of our products, services, and content. We'd like to take this opportunity to thank all of our readers for their consistent support and feedback.

Is there anything that you'd like us to cover in 2019? Any particular trend, topic, or technique? Please let us know in the comments below or through social media ([Twitter](https://twitter.com/auth0), [LinkedIn](https://www.linkedin.com/company/auth0)). As always, you can subscribe to our newsletter to receive a weekly digest of our blog content.

Happy Holiday Season!

<include src="asides/AboutAuth0" />


10 Most-Popular Developer Posts in 2018

a8912bdc06ed413351524360cc642cf2_400x400 avatar

a8912bdc06ed413351524360cc642cf2_400x400

Peter Shaw

Learn about Nancy, an open-source and lightweight alternative to the ASP.NET MVC framework.

Meet Nancy, a Lightweight Web Framework for .NET

kim-noel

Former Auth0 Employee

Kim Noel

What do apple picking, beer festivals, ghosts and goblins, and open-source all have in common?



We at Auth0 are excited to announce our participation in this years Hacktoberfest!

![Hacktoberfest 2018 logo](https://images.ctfassets.net/23aumh6u8s0i/64mee50TQDaqpOjwCo80bw/02fe61e51cd3a3935267e45bbbc652aa/hacktoberfest_logo)

## Hold up — What's Hacktoberfest?

[DigitalOcean](https://digitalocean.com/), [GitHub](https://github.com/), and - new for this year - [Twilio](https://www.twilio.com/) have partnered up for a month-long celebration of open-source software (OSS). This takes place from October 1st to October 31st inclusive, and you can sign up at any time during the month. This event facilitates the ability to be a part of a growing movement to encourage and contribute to open-source software. 

<include src="TweetQuote" quoteText="If you have never contributed to an open-source project before, there is a #hacktoberfest My-First-PR Starter Project at https://my-first-pr.github.io/hacktoberfest-2018/ available that you can use to practice making changes and creating pull requests"/>

Have you been looking for an opportunity to contribute to an open-source project? Had a hard time getting started? Been searching for a sign? _This is your sign!_ This is your chance to give back to the amazing projects that you and others alike use on a daily basis. Take advantage of this opportunity to help build a stronger product and have your voice heard! No contribution is too small: bug fixes to documentation, updates to translations, and much more are valid ways of participating.  

This month we get to see a lot of extra support to help folks get involved in open-source software and it’s with great enthusiasm we want people to take advantage of this! There are a large number of resources available to help you find a project and make your first contribution. Or, if it’s not your first, your next contribution. There are [many stories to read](https://medium.com/@thepriefy/my-first-github-pull-request-and-hacktoberfest-2017-a83622020390), and articles outlining [ways to get involved](https://medium.freecodecamp.org/i-just-got-my-free-hacktoberfest-shirt-heres-a-quick-way-you-can-get-yours-fa78d6e24307).

And guess what? This event has been taking place, every October, for 5 years!

_Happy five years of Hacktoberfest!_

A huge shoutout to DigitalOcean on a happy 5 years of Hacktoberfest. 

## How Do I Get Involved? 

First of all, sign up to the event on the [DigitalOcean Hacktoberfest site](https://hacktoberfest.digitalocean.com/), then head over to GitHub and take a [look through the projects](https://github.com/topics/hacktoberfest). These are all the open-source projects on GitHub that have the designated ‘hacktoberfest’ label. Another way to get started might be to look at the projects you use every day - they may just be open source!

If you have never contributed to an open-source project before, there is a [Hacktoberfest My-First-PR Starter Project](https://auth0.com/blog/a-first-timers-guide-to-an-open-source-project/) available that you can use to practice making changes and creating pull requests, before progressing to adding real value to other repositories that people depend on every day.

Furthermore, if you’re interested in [hosting your own Hacktoberfest event](https://hacktoberfest.digitalocean.com/eventkit), there is an event kit containing a guide on how to get started and run your event in the best possible way. You don’t have to be an expert or professional to host an event, just the passion and the time to get organized!

## It’s Not Just About the Swag 

Did someone say swag? Yes, there is swag! Swag is great and if you are fortunate enough to be a recipient of one of the exclusive Hacktoberfest t-shirts, we encourage you to wear it with pride knowing you were a part of a great movement for OSS. _That_ is why we encourage you to participate and earn the exclusive 2018 Hacktoberfest t-shirt! 

To qualify for your t-shirt, you just have to make 5 valid contributions as pull requests (PRs) into any public GitHub repository (your pull requests don’t have to be merged in that time). Of note is that it's OK to submit one PR to fix a typo, but submitting 5 PRs to remove extra whitespace here and there is not. T-shirts get sent out after October and can take a few weeks to a few months to arrive. 

Therefore, let’s take a quick look: submit **5 or more pull requests** and get an exclusive Hacktoberfest t-shirt courtesy DigitalOcean, GitHub & Twilio.

<include src="TweetQuote" quoteText="All of our #hacktoberfest projects can be found on our GitHub organization. Join us over in https://community.auth0.com if you have any questions or feedback."/>

## What If I Submit to an Auth0 Project?

At Auth0, [we’re heavily invested in the open-source software movement](https://auth0.com/opensource). Look out for a kickass 2018 Hacktoberfest t-shirt courtesy of the awesome Auth0 team, along with a psychedelic Auth0 sticker pack!

All of our qualifying projects can be found on [our primary GitHub organization](https://github.com/auth0), as well as [our community organization](https://github.com/auth0-community). Join us over in [community.auth0.com](https://community.auth0.com/) if you have any questions or feedback.

To notify us of your contribution(s), please submit your details in this [Google form]( https://goo.gl/forms/sNo604XkIMhCX8i03) and we will follow up at the end of the event with your swag! 

## Share Your Journey!
We want to hear how your Hacktoberfest journey is going, so make sure to use the #Hacktoberfest hashtag and, if you’re working with Auth0 this month, use #Auth0OSS. We will be re-sharing our favorites! 

## Have an Open-Source Project, and Looking for Contributions?
Share it in our [Community Corner](https://community.auth0.com/c/community-corner)! If you built something with Auth0 share it in our [Show Your Auth0 section](https://community.auth0.com/c/auth0-community/show-auth0/16). Inspire others and be inspired! Celebrate your hard work and let your project be shared with other amazing developers. 


Celebrate Hacktoberfest 2018 with Auth0!

956290?s=200

R&D Content Engineer

Luke Oliff

Open source is the past, present, and future. Pay it forward by learning how to make your first contribution with Auth0.

A First Timers Guide to an Open Source Project

idee

Software Engineer building with Kotlin and Flutter.

Software Engineer at Busha

Idorenyin Obong

How to configure a Continuous Deployment pipeline utilizing Now.sh, GitHub, and Travis CI to automate your open-source Node.js web apps.

Continuous Deployment Pipelines and Open-Source Node.js Web Apps

bb9128fac91692ad4f46a785d772dd39?s=200 avatar

bb9128fac91692ad4f46a785d772dd39?s=200

Data Scientist and Engineer, I love tinkering with data!

Head of Data

Pablo Seibelt

Learn how to leverage Auth0 to have Shiny Authentication for the open source version or another legacy website.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Some content in this post is outdated. Check our <a href="https://auth0.com/blog/adding-authentication-to-shiny-server/">updated guide</a>.</strong>
</div>


[Shiny Server](https://www.rstudio.com/products/shiny/shiny-server/)  is a great solution for BI/analytics reporting. It leverages all the power of the [R language](https://www.r-project.org/), which is the most popular open-source language for statistics, and it has a lot of useful functions for *Data Mining*, *Machine Learning*, *Reporting*, etc.

<include src="TweetQuote" quoteText="Shiny Server is a great solution for BI/analytics reporting."/>

The open-source version of Shiny Server features no Authentication, and if it's open on Internet, it leaves your data exposed. In that case, you likely won't want everyone on the Internet to be able to see your internal analytics, so you'll need to install and configure the authentication yourself.

One of the easiest ways to add authentication to Shiny and, by extension, any unsecured web application, is to use Apache with Auth0 through the **auth_openidc** module.

This is also useful if you have a legacy web app with a username and password everyone shares or if you are hosting a server with static files you want to share.

![Diagram of the Shiny Authentication scheme](https://images.ctfassets.net/23aumh6u8s0i/1X0EfCJlUSk3CSdyrX73W5/be36fbf08b114b587aa265ebc73987a9/pub_w_959_h_638)

So, let's get started with the steps.

## Installing and Configuring Shiny

First, follow the instructions to [install and configure Shiny Server](https://www.rstudio.com/products/shiny/download-server/).

When you have installed and configured Shiny and you're sure it works, modify your config file so it only serves to 127.0.0.1 (the local machine). This ensures that we don't accidentally expose the open server to the entire Internet.

```
[...]
server {
  listen 3838 127.0.0.1;
[...]
```

## Installing Apache and the OpenID Connect Module

We will use Apache as a gateway to our app using [Auth0's tutorial](https://auth0.com/docs/server-platforms/apache). This will enable Apache to serve as a gatekeeper—a reverse proxy that only serves after authentication.

If you don't already have apache2 installed, install it according to your platform and ensure that you have two modules: mod_proxy and mod_auth_openidc.

mod_proxy is pretty standard. It comes with most apache2 installs, but it is often disabled. To enable it, execute the following with root:

```
a2enmod proxy_http
```

mod_auth_openidc is provided in Debian as libapache2-mod-auth-openidc. Binary packages are available at [the releases page](https://github.com/pingidentity/mod_auth_openidc/releases), or you can always [build it from source](https://github.com/pingidentity/mod_auth_openidc/blob/master/INSTALL). When it is installed, enable it with this command:

```
a2enmod auth_openidc
```

## Configure an Auth0 Account

If you don't already have an Auth0 Account, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">create one here</a> and set up the type of connections you want to allow. The default settings allow anyone to sign up, but you can set up a better scheme. For example, if you use Google Apps, you can just connect that and [allow only those from your domain to access the server](https://manage.auth0.com/#/connections/enterprise). Alternatively, you can use [rules](https://manage.auth0.com/#/rules) to decide which users are allowed access.

You can [browse the docs](https://auth0.com/docs) or [ask for help](https://support.auth0.com) setting up the best scheme for your scenario.

## Configure Apache to Serve Shiny with Auth0

Make sure Shiny is running in the background while Apache tries to serve it. You can ensure that it's always on by [running it as a Daemon](https://rstudio.github.io/shiny-server/latest/#stopping-and-starting).

You will need to follow the steps in [the Apache tutorial](https://auth0.com/docs/server-platforms/apache). Note: when you are logged in to Auth0, the tutorial includes your own variables in the configuration to make it easier for you.

Create a configuration file for your website using the configuration from the tutorial as a starting point. Replace everything from OIDCProviderIssuer to Location with the code in the tutorial.

You will need to personalize your OIDCRedirectURI. I recommend using https://<your_apache_server>/auth. Of course, replace <your_apache_server> with the public address that will be used for your server.

You also need to generate or write some random string on <passwordToEncryptTheSessionInformationOnTheCookie>

You should at least have a [self-signed SSL certificate](https://devcenter.heroku.com/articles/ssl-certificate-self) to test and a real one to deploy.

It should look something like this:

```
<VirtualHost *:443>
  ProxyPass / http://localhost:3838/
  ProxyPassReverse / http://localhost:3838/
  ProxyPreserveHost On

  OIDCProviderIssuer https://<your-tenant>.auth0.com
  OIDCProviderAuthorizationEndpoint https://<your-tenant>.auth0.com/authorize
  OIDCProviderTokenEndpoint https://<your-tenant>.auth0.com/oauth/token
  OIDCProviderTokenEndpointAuth client_secret_post
  OIDCProviderUserInfoEndpoint https://<your-tenant>.auth0.com/userinfo

  OIDCClientID <YourClientID>
  OIDCClientSecret <YourClientSecret>

  OIDCScope "openid profile"
  OIDCRedirectURI https://<your-website>/auth
  OIDCCryptoPassphrase <passwordToEncryptTheSessionInformationOnTheCookie>
  OIDCCookiePath /

  SSLEngine on
  SSLCertificateFile /path/to/server.crt
  SSLCertificateKeyFile /path/to/server.key

  <Location />
     AuthType openid-connect
     Require valid-user
     LogLevel debug
  </Location>

</VirtualHost>
```

You can save it somewhere like ``/etc/apache/sites-available/001-shiny` and then link it to make it active:

```
ln -s /etc/apache/sites-available/001-shiny /etc/apache/sites-enabled/001-shiny
```

As the tutorial states, Auth0's `clientSecret` is by default Base64 encoded, which isn't compatible with this Apache plugin out of the box. We're going to change that in the near future, but in the meantime, you need to call an API to make sure the clientSecret isn't Base64 encoded for your account.

Get an access token by clicking "Try Me!" on the [docs page](https://auth0.com/docs/api/v1#!#post--oauth-token) and execute the code shown in step 3 of the tutorial to change `ACCESS_TOKEN` to the access token you just received.

## Boom.

Now you have a Shiny Server that is secured with Auth0, which you can use to serve reports only to employees of your organization using username and password authentication or [one of the many identity providers supported](https://auth0.com/docs/identityproviders).

This same configuration works well for other cases. For example, suppose you have an old legacy web application for which everyone uses the same password. That scenario is not very safe, is it? You can give it an additional security layer with the above approach without modifying your site.

## Gotchas

Shiny uses websockets for a lot of things. While we haven't explored tunneling, it is theoretically possible with **proxy_wstunnel**. For most users, this will work fine because if the library fails with websockets, it will automatically fall back to XHR.


Adding Authentication to Shiny Open Source Edition

ryan-chenkie

Ryan is a full-stack JavaScript developer and trainer who mainly works with React, Angular, Node, and GraphQL. He runs a consultancy where he builds apps for companies and also helps established dev teams with their modern JavaScript challenges.<br /><br />Ryan is a Google Developer Expert, the host of the Entrepreneurial Coder Podcast, the author of Securing Angular Applications, and an all-around fanatic about application security.

Developer

Ryan Chenkie

Learn the essentials of Falcor--the newly open-sourced library from Netflix that lets you represent your data as a single virtual JSON object.

Getting Started With Falcor

d48b998c2dce49ca309710eba498c562

Nathan Totten

Remembering usernames and passwords and login urls for all of these apps is a pain. With this app we take another step in simplifying the authentication experience.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Update:</strong> The Single-Sign-On Dashboard referred in this article is now deprecated and has been replaced with the extension that can be found here: <a href="https://auth0.com/docs/extensions/sso-dashboard">Auth0 Extension: Single Sign-On (SSO) Dashboard</a>.
</div>

**tl;dr**: Control which apps your users can access with an SSO dashboard. Download the [code](https://github.com/auth0/auth0-sso-dashboard) or [deploy to Heroku](https://dashboard.heroku.com/new?template=https%3A%2F%2Fgithub.com%2Fauth0%2Fauth0-sso-dashboard) in 5 minutes.

Today, we are excited to announce the release of the Auth0 [Open Source Single-Sign-On Dashboard](https://github.com/auth0/auth0-sso-dashboard). This SSO dashboard is designed to solve a problem familiar to many people. Organizations of all sizes maintain a variety of different applications to handle various business functions like accounting, HR, development, support, etc. Remembering usernames and passwords and login urls for all of these apps is a pain. With this app we take another step in simplifying the authentication experience.

<include src="TweetQuote" quoteText="Today, we are excited to announce the release of the Auth0 Open Source Single-Sign-On Dashboard."/>



![SSO Dashboard](https://images.ctfassets.net/23aumh6u8s0i/52rZ04u2zwgwGtEGzjtim0/4c2a917d6d5fe7fd6a01b84a99e20db0/cfENOYpKxfL_)

You can find the entire source of this project on [Github](https://github.com/auth0/auth0-sso-dashboard) along with instructions on how to deploy and configure a dashboard for your own organization. Additionally, you can try out a demo version (with non-functional apps) at [https://ssodashboard.herokuapp.com](https://ssodashboard.herokuapp.com). Username: `publicdemo` Password: `TestUser123`. This demo only shows the user functionality; if you would like to see the full admin capabilities, please deploy your own instance.

A few key features of the SSO Dashboard:

* Landing page showing all apps that a user is allowed to access.
* Self-service user profile updates.
* Administrator interface for configuring roles, apps, and users.
* Completely customizable UI.

## Completely Open Source
Our approach to this project, like many projects at Auth0, was to build this as an open source app. This approach gives our users the most flexibility while still being very easy to maintain and receive updates.

* Node.js Backend (Express)
* React, Flux, and React-Router
* Bootstrap ([Paper Theme](https://bootswatch.com/paper/)) and [Material UI](http://callemall.github.io/material-ui/#/)
* [Babel](https://babeljs.io/) to enable ES6
* [Webpack](https://webpack.github.io/) for asset bundling

Feel free to fork and clone this project. We will accept pull requests and [issues](https://github.com/auth0/auth0-sso-dashboard/issues) if you want to contribute back.

If this is something you have been looking for at your company or organization do give it a try. Let us know what you think, we will be adding features based on feedback.

Announcing the Auth0 Open Source Single-Sign-On Dashboard

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

Startup in-a-Box Bootcamp In partnership with Microsoft, NXTP Labs, Mural.ly and Ideame, Auth0 is very proud to have hosted the the Global Windows Azure

### Startup in-a-Box Bootcamp

In partnership with Microsoft, [NXTP Labs](http://www.nxtplabs.com/), [Mural.ly](http://mural.ly) and [Ideame](http://idea.me), [Auth0](https://auth0.com) is very proud to have hosted the the [Global Windows Azure Bootcmap](http://globalwindowsazure.azurewebsites.net) in [Buenos Aires, Argentina](http://azurenodebootcamp.eventbrite.com).

This is an event that happened simultanesouly around the globe in **93 cities**!

Our theme for the event was: __"Startup in-a-box"__. We wanted to share with the community  what we have been using to get our Startup going:  our __tools__, __frameworks__, and  __processes__ that we use daily in our company.

### Some numbers

These are some numbers for the day:

* **40** showed up on Saturday. That's a pretty good turn up of all registered users. Clearly,  there's interest, thanks everyone!
* **Everyone** stayed till 6pm (that is 9 hours of training on a Saturday!)
* Very high level of satisfaction: **90%** of the attendees rated the event gave at the **highest score**.
* **6** presentations and Hands on Labs, covering **node.js, mongodb, Windows Azure, Auth0, GitHub and Jenkins**
* **8** organizers (most of them working on startups) to make sure everyone could get their questions answered:
   * [Jose Romaniello](http://twitter.com/jfroma) from [Auth0](https://auth0.com)
   * [Sebastian Iacomuzzi](http://twitter.com/sebasiaco) from [Auth0](https://auth0.com)
   * [Fede Jack](http://twitter.com/fedejack) from [Auth0](https://auth0.com)
   * [Johnny Halife](http://twitter.com/johnnyhalife) from [Mural.ly](http://mural.ly)
   * [Juan Pablo Garcia](http://twitter.com/liarjo) from Microsoft
   * [Juan Pablo Garcia](http://twitter.com/jpgd) from [Ideame](http://idea.me)
   * Valentina Milano from Microsoft
   * [Matias Woloski](http://twitter.com/woloski) from [Auth0](https://auth0.com)



Thanks Microsoft for helping with the logistics: venue and food.

### Community reaction

Twitter is often a good sensor of how an event is going:

<blockquote class="twitter-tweet"><p>Muy bien organizado el <a href="https://twitter.com/search/%23MeQuieroIrAlBootcamp">#MeQuieroIrAlBootcamp</a>: 8 horas tremendas que se me pasaron volando.</p>&mdash; DiegoRam (@DiegoRam) <a href="https://twitter.com/DiegoRam/status/328234714773209089">April 27, 2013</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet"><p><a href="https://twitter.com/search/%23MeQuieroIrAlBootcamp">#MeQuieroIrAlBootcamp</a> <a href="https://twitter.com/search/%23GlobalWindowsAzure">#GlobalWindowsAzure</a> gran bootcamp!. Muchas gracias! @<a href="https://twitter.com/jfroma">jfroma</a> @<a href="https://twitter.com/woloski">woloski</a> @<a href="https://twitter.com/auth0">auth0</a> jonny y otros</p>&mdash; Andrés Falcón (@_andresff) <a href="https://twitter.com/_andresff/status/328260849716318209">April 27, 2013</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet"><p>Excelente el <a href="https://twitter.com/search/%23GlobalWindowsAzure">#GlobalWindowsAzure</a> de Buenos Aires, con @<a href="https://twitter.com/woloski">woloski</a> @<a href="https://twitter.com/johnnyhalife">johnnyhalife</a> @<a href="https://twitter.com/jfroma">jfroma</a> @<a href="https://twitter.com/liarjo">liarjo</a></p>&mdash; Juan Manuel Arias (@juanma_ari) <a href="https://twitter.com/juanma_ari/status/328913141465497600">April 29, 2013</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

## Some pictures

<iframe src="https://cloudup.com/cJ28lIHJjXp?chromeless" style="width: 100%; height: 400px"></iframe>

## The Bootcamp content is Open Sourced on GitHub!

The content we delivered on the bootcamp was a mix of 30-minutes presentations, followed by time for practicing the concepts with simple excercises. This content represents what we would have liked to see when we started our companies. It also captures what we've learnt through the last months.

The best content is the one that people actually use and tweak over time. We decided to contribute it to the broader community so it becomes live.

### <https://github.com/auth0/bootcamp-workshop>

<a href="https://github.com/auth0/bootcamp-workshop" target="_blank"><img src="https://images.ctfassets.net/23aumh6u8s0i/1C71vWmGJm8UT4L6O1Zfm6/67ea4badfb5f9882e9471eecd5734485/bootcamp-github" style="width: 100%"/></a>


### Our Vision

Argentina has a vibrant entrepeneur community. There are two accelerators and lots of startups.

There's quite a bit of content around the "soft" aspects of building a startup. There are many talks available from successful entrepeneurs, investors. There're meetups on marketing and pitch clinics. There's Palermo Valley. But we felt there were fewer opportunities for technical people to connect and share their experiences.

We often hear questions like:

* What __options__ do I have for storing data?
* What are the __pros/cons__ of each option?
* What are __common mistakes__ people make? How do I __avoid__ them?
* What does your __build environment__ look like?
* What __tools__ you use?
* How to tell whan something is __hype__ or __real__?

Given that last Saturday was such a good experience, we asked ourselves: why not do this more often?

So [stay tuned](http://twitter.com/auth0)...we'll have more news to share with you soon.

"open source"