What are the risk of providing identity in my application, rather than using a provider?

Question

In our multi tenant SaaS software application we intended to use Microsoft Identity Platform (Azure AD) for user authentication and providing the claims for authorization within the application. We are facing a lot of difficulties managing and getting the correct claims throughout the stack and are now considering providing our own identity and web tokens (through a library like Microsoft.AspNetCore.Identity).

This means we would still rely on Azure AD for the authentication, but then use our own (synchronised) identities to manage application roles, permissions, etc and store these in the application database.

Q: What are the security risks we will be exposed to when we provide our own identity rather than use a service for these, keeping in mind we would still use a service for the authentication?

Answer 1

But, the biggest issue stems from not leaving the identity up to the experts that have studied the numerous standards and security policies. Sure, you could learn all of it yourself and implement it securely, but it will be time and resource consuming. That's just the tradeoff you have to make (as it is with many SaaS solutions).

If you're storing the identities in your application database, you open the door to a hacked application leading to hacked identities. Versus if it were separate, you could have better encapsulation there. Bad practices in storing passwords or passing them over unencrypted protocols could lead to stolen identities.

*I'm biased as I work for an Identity Provider, but I've tried to be completely open and honest here.

Answer 2

What are the security risks we will be exposed to when we provide our own identity rather than use a service for these

1. Why do you think handling roles and permissions would expose you to security risks? ASP.NET can provide the exact same security functionality with claims and roles stored in your own local database which is arguably SAFER than a cloud provider.

2. When did it happen that people now blindly trust gigantic corporations with unnecessary power over their own technology?

You could just as easily have asked what security risks would be exposed by depending on a 3rd party which doesn't care about your business, monopolizes their industry, already has enough money, is a target for hackers and espionage, has many different attack vectors, has ties to governments and intelligence agencies, hates privacy, and absolutely loves to datamine.

Answer: You won't be exposed to any more security risks than you already were.

Using Azure doesn't magically make you safer. It's still a database. Use a strong password hashing algorithm for authentication. Make sure you keep your credentials safe, sensitive data encrypted, and your database exposed only to the servers using it, and you will be totally fine.