I built a small on-call tracker for my team in a few hours, but then spent most of the day trying to restrict access to six specific people. I ended up putting one shared password in our team chat. It works, but I don't like that anyone who gets the password can access the tool, and changing it affects everyone. Building a complete login system for six users feels excessive. What practical approach would you use instead?
3 Answers
Don’t rely on IP addresses or computer names for access control. People working from home will have changing networks, and those signals are easy to get wrong or spoof. Login alerts can be useful for unusual activity, but notifying the whole team about every normal login will probably become noise. Individual account access through your company accounts is the cleaner option.
The best balance is probably using your existing Google Workspace accounts with a hosted sign-in provider, then checking the signed-in email against an allowlist of the six approved users. You get individual identities, account removal, password recovery, and an audit trail without having to build user management yourself. Even if you don’t have a separate identity provider, Google Workspace can usually handle the authentication through OAuth or OpenID Connect.
If you absolutely can’t use an existing identity provider, give each person a separate credential rather than sharing one password. That way you can revoke or replace one user’s access without disrupting everyone else, and you have at least some idea of who logged in. It’s still a compromise, though, so I wouldn’t use it for anything especially sensitive.
That makes more sense than one shared password. I was mainly worried about accidentally creating a fragile mini-auth system, but separate credentials would at least limit the damage if one leaks.
That sounds like the direction I should take. The part I keep getting stuck on is configuring the Google sign-in and the allowlist, but it’s still less work than building passwords and session handling from scratch.