Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Any comprehensive courses on Auth?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 93 posts

Re: Ask HN: Any comprehensive courses on Auth?

#41

Post by shadowbanned4 »

krantic wrote: post #7

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…

This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.

Re: Ask HN: Any comprehensive courses on Auth?

#42

Post by d4mi3n »

A bit salse-y, but Oso has a pretty nice overview on the problems that led to their product and how they reason about AuthN/AuthZ: https://www.osohq.com/academy

It's more focused on application level architecture rather than the whole domain of AuthN/AuthZ, but I've found it's a decent reference for folks unfamiliar with a lot of the common issues one encounters in implementation.

Re: Ask HN: Any comprehensive courses on Auth?

#43

Post by BennyInc »

krantic wrote: post #7

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…

I can second Hackmanit from my own experience. We had them come on site some years ago to train our team. This was incredibly helpful as they also focused on what we use in house in a separate chapter.

Re: Ask HN: Any comprehensive courses on Auth?

#44

Post by mooreds »

shadowbanned4 wrote: post #41
krantic wrote: post #7

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…

This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.

It depends!

(I work for an auth vendor, so where I stand depends on where I sit, to some extent.)

I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all.

I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to:

* support slack-like workspace switching functionality for a single user

* but allow each organization to control the login methods they want to allow, including magic links, SAML, OIDC, LDAP, etc

* and make all APIs securely and scalably available to single page applications and mobile applications

* across hundreds of thousands or millions of users

You're going to want to use some of the more complicated standards. Basic auth ain't gonna help with that.

Re: Ask HN: Any comprehensive courses on Auth?

#45

Post by shadowbanned4 »

mooreds wrote: post #44
shadowbanned4 wrote: post #41

Earlier quoted context omitted.

This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.

It depends! (I work for an auth vendor, so where I stand depends on where I sit, to some extent.) I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all. I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to: * support slack-like workspace switching functionality for…

I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.

Re: Ask HN: Any comprehensive courses on Auth?

#46

Post by mooreds »

shadowbanned4 wrote: post #45
mooreds wrote: post #44

Earlier quoted context omitted.

It depends! (I work for an auth vendor, so where I stand depends on where I sit, to some extent.) I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all. I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to: * support slack-like workspace switching functionality for…

I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.

They still used basic auth across all their apps?

Re: Ask HN: Any comprehensive courses on Auth?

#47

Post by dickhardt »

shadowbanned4 wrote: post #41
krantic wrote: post #7

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…

This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.

OAuth 2.0 took the best features of what was already being deployed by Google, Microsoft, Yahoo, etc. and added in scopes and refresh tokens. The objective was to standardize how to delegate authorization so that developers did not have to learn slightly different ways of doing effectively the same thing.

Typing your username and password into a 3P website so it could crawl your contacts was horrible anti-pattern.

Re: Ask HN: Any comprehensive courses on Auth?

#48

Post by jonasmerlin »

withinboredom wrote: post #24
jonasmerlin wrote: post #12

Earlier quoted context omitted.

Actually, I think we're doing a huge disservice to our profession as programmers when we call stuff like this "an insane number of gotchas". This is no critique of you or your post specifically, mind you, and I know where you're coming from. But it's a critique of a general tendency among programmers to call anything that requires a bit of knowledge and thought beyond the simplest surface level solution "complex" or…

I don't know why you're getting downvoted (I have no idea why people are on HN if they think this is just Reddit. If you downvote, say why and start a discussion), but you're right. My intent wasn't to imply "just don't do it" or "leave it to libraries." I was trying to say why you can't really find a guide like the post is asking for (at least for free!) and it likely has a lot to do with liability and things like t…

Haha, thanks for your reply and for understanding where I'm coming from. And while your original comment might not be a _direct_ reply to OPs question, I would've hoped for it to be far more upvoted as well, as it's easily one of the most valuable comments in this thread in my opinion. HN truly is weird sometimes.

The only thing I took issue with in your original comment was the "The number of gotchas in this simple 3-step process is insane" and the "there are so many gotchas" parts, as I think that this exact wording made me read the whole thing in a wrong way. I just wish we would tell people new to these kinds of topics "Don't fear this, this is normal, but totally manageable! It might seem like a minefield at first, but actually, there's a very well-trodden path through it. Here's (part of) the map." (Basically,you provided that map, which is great, and more than people genrally do, but the wording above made the map seem more daunting than I would wish.)

Re: Ask HN: Any comprehensive courses on Auth?

#49

Post by dickhardt »

mooreds wrote: post #36
sgt wrote: post #29

There's also the RFC on OAuth2: https://datatracker.ietf.org/doc/html/rfc6749 The introduction will give you a bit of a background. The most important to read (for now) is just the introduction up to chapter 2.

As mentioned elsewhere, I'd probably start with OAuth2.1 (not quite a standard but well on its way) as this updates the OAuth2 standard, as well as consolidates lots of improvements. https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...

OAuth 2.1 has no new features. It is OAuth 2.0 rolled up with all the specs since 2.0. It is the better place to start for learning about delegated authorization.

Re: Ask HN: Any comprehensive courses on Auth?

#50

Post by dickhardt »

sgt wrote: post #29

There's also the RFC on OAuth2: https://datatracker.ietf.org/doc/html/rfc6749 The introduction will give you a bit of a background. The most important to read (for now) is just the introduction up to chapter 2.

Nice to hear that has stood the test of time. :)
Post reply on HN