I built a small on-call tracker for my team in a few hours, but then spent most of the day trying to restrict it to six specific people. I ended up putting one shared password in our team chat because it was quick, but that feels hard to control and easy to leak. Building a complete login and user-management system for only six users also seems excessive. What practical approach would you use for a small internal tool, especially when the team works from both the office and home?
3 Answers
If integrating with an identity provider is not practical yet, six separate passwords are still safer than one shared password. Give each person a different credential, store only properly hashed passwords, and make it easy to revoke or replace one account independently. That is a compromise rather than a complete security design, but it gives you at least some user-level auditing and limits the impact of one leaked password. Avoid relying on computer names or IP addresses, since people work from changing networks.
The best middle ground is usually signing in through an existing company identity provider, such as Google Workspace or Microsoft 365, and checking the signed-in account against an allowlist of those six people. You get individual identities, account removal, password resets, and an audit trail without implementing any of that yourself. If you do not have a formal identity provider, Google Workspace can still provide the accounts and OAuth-based sign-in. A shared password is difficult to revoke or audit once it has been posted in a chat.
That sounds like the direction I want. The SSO setup is the part I keep getting stuck on, since we only have Google Workspace accounts and no separate identity platform.
Login notifications can be useful for a sensitive tool, especially when they include the account and time, but they can quickly become noise for a frequently used tracker. I would prioritize individual authentication and access removal first, then add alerts for unusual events such as a new device, repeated failures, or access by someone who is no longer on the allowlist.
People work from home, so IP-based restrictions would not really help us. Individual credentials may be my fallback if I cannot get the Google sign-in working.