Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Hydra – Open-Source OAuth2 Server

gethydra.sh

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Show HN: Hydra – Open-Source OAuth2 Server

#11

Post by cookiecaper »

I was just researching OAuth servers last week and came across Hydra several times. Congrats all on a big release!

Ran across some unexpected drama while poking around: apparently, one of the main authors of OAuth2 spec withdrew his name from the publication and has repeatedly publicly derided the standard. https://vimeo.com/52882780. Parts I heard were good.

I'd just like to make a small request that developers on tiny internal-only APIs not make a big ordeal out of OAuth and require a big honking session store anchored against the "user's" OAuth creds on every internal, service-to-service request, thanks.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#12

Post by atonse »

vwpolo3 wrote: post #9
atonse wrote: post #7

Earlier quoted context omitted.

If we have to implement all those things, is there really much of a remaining lift in implementing OIDC, apart from bringing in a library into a web app?

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

Ok makes sense, thanks (it was a genuine question, sounds like those protocols are quite complex.)

Re: Show HN: Hydra – Open-Source OAuth2 Server

#13

Post by vwpolo3 »

cookiecaper wrote: post #11

I was just researching OAuth servers last week and came across Hydra several times. Congrats all on a big release! Ran across some unexpected drama while poking around: apparently, one of the main authors of OAuth2 spec withdrew his name from the publication and has repeatedly publicly derided the standard. https://vimeo.com/52882780 . Parts I heard were good. I'd just like to make a small request that developers on…

The blog posts and discussion was long ago (the video is 6 years old). Since then, that particular author acknowledged that (iirc) OpenID Connect solves many of the things he criticized. I have to look up the source, it’s been a while.

However, OIDC and OAuth2 are complex protocols which is also why we encourage most greenfield and small projects to avoid it unless explicitly required.

It’s also important to note that that particular person voiced criticism, but most of the biggest names in tech (GCP, AWS, ...) heavily rely on those protocols (+ extensions). His proposed alternative protocol Oz never got to real world adoption (to my knowledge) and has recently been archived. The prediction that we would see major OAuth2 security wholes within 3 years (so 2015j never came true. It doesn’t mean that he was wrong, but that there are opinions that contradict him, and that those opinions and voices have established themselves in the industry.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#14

Post by manigandham »

Ken_Adler wrote: post #6

In my research, Hydra is the only OSS OIDC server implementation that is built from the start in a modern, containerized manner.

https://identityserver.io/

https://fusionauth.io/

https://www.keycloak.org/

https://www.gluu.org/

Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#15

Post by manigandham »

vwpolo3 wrote: post #9
atonse wrote: post #7

Earlier quoted context omitted.

If we have to implement all those things, is there really much of a remaining lift in implementing OIDC, apart from bringing in a library into a web app?

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

Bringing in a library is different from building it from scratch. Pretty much every language has solid OIDC frameworks now.

OIDC is great for greenfield and much better than writing user signin flow every time.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#18

Post by wikibob »

vwpolo3 wrote: post #9
atonse wrote: post #7

Earlier quoted context omitted.

If we have to implement all those things, is there really much of a remaining lift in implementing OIDC, apart from bringing in a library into a web app?

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

What is the suggested solution for Greenfield development?

Re: Show HN: Hydra – Open-Source OAuth2 Server

#19

Post by plange »

vwpolo3 wrote: post #9
atonse wrote: post #7

Earlier quoted context omitted.

If we have to implement all those things, is there really much of a remaining lift in implementing OIDC, apart from bringing in a library into a web app?

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

This is NIH syndrome. You're way better off following the standards, and likely implementing standard libraries to actually make use of them.
Post reply on HN