Reduce Your Perms. Mgmt. Time While Protecting Your Users
summary
Project migrates permission logic out of Django into Okta SaaS, Okta SSO for authentication and group-based roles, removes the ad hoc superuser model (team hits 35 superusers within weeks) and removed superuser as writable role. Implementation adds a business published permission and maps many Django perms into a small set—keeps two admin permissions for simplicity—reducing permission bugs and letting supervisors self-manage, while exposing duplication of group state, occasional over-granting by supervisors, and a delayed Okta breach notification in 2020.
AI-written summary · about
chapters (16)
- 0:00Permission management challenges
- 1:54Broken access control examples
- 2:57Project context and complexity
- 4:04Django permission issues
- 7:39Super users to role-based access
- 9:31DAC problems in Django
- 11:44Security gaps and external solutions
- 13:30Evaluating SAS options
- 15:20Okta for role-based access
- 17:10Okta incident and lessons
- 18:17User experience with Okta
- 20:03Feedback on Okta
- 21:50Key takeaways
- 22:56Preventing user errors
- 23:38Permission oversight visuals
- 24:41Q&A
related talks
45mTemporary Access to the Cloud: A Case Study
35mExternal authentication for Django projects
25mIdentifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach
30mHeard you liked access, so we built Access to...
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP
45mUnder Odoo's Hood: Secrets of an unbreakable permissions architecture
44mManaging Identities: LDAP, Google Directory, and Django
18mShifting Authentication at Scale