Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Hydra – Open-Source OAuth2 Server

gethydra.sh

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Show HN: Hydra – Open-Source OAuth2 Server

#31

Post by manigandham »

quelltext wrote: post #23

I'm not too familiar with this space, so please excuse my question. What is OAuth2 server is? I was under the impression that for a given service/API typically OAuth2 is implemented by the provider on their servers, either from scratch or using some sort of library. With an OAuth2 server are you running a separate server or is it an internal service that your application code connects to (and forwards requests?) when…

Authentication = who are you. Authorization = what are you allowed to do.

OAuth 1.0/2.0 are a set of protocols and standards allowing applications to identify users and get access to their data using existing profiles. OAuth is mostly focused around authorization with claims (which are just key-value pairs) and authentication was an afterthought.

OpenID is another standard designed to let people authenticate across the web, launched with a lot of hype in the early web 2.0 days but never took off. OpenID Connect (OIDC) is a new standard based on OAuth 2 + OpenID to provide both authentication and authorization in a single flow.

OIDC/OAuth is all based on tokens, which are usually JWTs containing a bunch of claims that can be validated against the server that issued them. There are ID tokens (for the user info) and Access tokens (for accessing an API on behalf of that user), but some services like social logins don't provide any access tokens. Other providers might have rate limits, or dont have fine-grained permissions, or you maybe you have completely internal APIs that you need tokens for.

A token/identity server like Hydra can take care of creating and managing all the tokens and grants, and all the OAuth token flows, in a central location between internal and external APIs and user providers.

It's really just a webapp with endpoints that implement all the protocols so you can run it as a service somewhere. Once you do, your apps can then just call the token endpoint to recognize users and your APIs can use it to validate incoming requests which have JWTs. You still need the logic in your code to use OIDC sign-in and/or JWT validation but this is standard functionality and easily available in every stack.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#32

Post by hans0l074 »

manigandham wrote: post #14
Ken_Adler wrote: post #6

In my research, Hydra is the only OSS OIDC server implementation that is built from the start in a modern, containerized manner.

https://identityserver.io/ https://fusionauth.io/ https://www.keycloak.org/ https://www.gluu.org/ Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.

Thanks for this list! I wonder why Identity Servier is tied into .NET - an OAuth 2.0 / OIDC provider just provides OAuth services. Couldn't this be used by any service provider or client?

Re: Show HN: Hydra – Open-Source OAuth2 Server

#33

Post by manigandham »

hans0l074 wrote: post #32
manigandham wrote: post #14

Earlier quoted context omitted.

https://identityserver.io/ https://fusionauth.io/ https://www.keycloak.org/ https://www.gluu.org/ Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.

Thanks for this list! I wonder why Identity Servier is tied into .NET - an OAuth 2.0 / OIDC provider just provides OAuth services. Couldn't this be used by any service provider or client?

It's a C#/.NET app but it's not tied to it. OAuth/OIDC is all HTTP endpoints and redirects.

IdentityServer does have more of a framework/library approach so you can integrate it into your own code and apps but there's a turnkey UI project available that just needs some settings in a JSON config file to get running.

https://github.com/IdentityServer/IdentityServer4.Quickstart...

They also have the only good OIDC javascript client that implements the new PKCE flow for client-side apps: https://github.com/IdentityModel/oidc-client-js

Re: Show HN: Hydra – Open-Source OAuth2 Server

#34

Post by quelltext »

manigandham wrote: post #31
quelltext wrote: post #23

I'm not too familiar with this space, so please excuse my question. What is OAuth2 server is? I was under the impression that for a given service/API typically OAuth2 is implemented by the provider on their servers, either from scratch or using some sort of library. With an OAuth2 server are you running a separate server or is it an internal service that your application code connects to (and forwards requests?) when…

Authentication = who are you. Authorization = what are you allowed to do. OAuth 1.0/2.0 are a set of protocols and standards allowing applications to identify users and get access to their data using existing profiles. OAuth is mostly focused around authorization with claims (which are just key-value pairs) and authentication was an afterthought. OpenID is another standard designed to let people authenticate across t…

Thanks for taking the time to write this up.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#35

Post by webhamster »

vwpolo3 wrote: post #13
cookiecaper wrote: post #11

I was just researching OAuth servers last week and came across Hydra several times. Congrats all on a big release! Ran across some unexpected drama while poking around: apparently, one of the main authors of OAuth2 spec withdrew his name from the publication and has repeatedly publicly derided the standard. https://vimeo.com/52882780 . Parts I heard were good. I'd just like to make a small request that developers on…

The blog posts and discussion was long ago (the video is 6 years old). Since then, that particular author acknowledged that (iirc) OpenID Connect solves many of the things he criticized. I have to look up the source, it’s been a while. However, OIDC and OAuth2 are complex protocols which is also why we encourage most greenfield and small projects to avoid it unless explicitly required. It’s also important to note tha…

Also, we now have formal proofs for the security of the OAuth and OIDC protocols.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#36

Post by webhamster »

unscaled wrote: post #28
vwpolo3 wrote: post #5

Earlier quoted context omitted.

While not explicitly mentioned, PKCE is supported! And yes, that draft was an important guide during implementation.

How do you deal with IdP/AS mix-up? The BCP recommends either sending back client_id and iss (but that draft[1] is long expired, and nobody seems to support that implementation), or asking the client to provider a separate exact-match return URI for each AS. The second solution is what I'm doing when implementing multi-AS/IdP OAuth clients, but this requires the clients to be aware of this vulnerability, and that's a…

There is no issuer in OAuth. Therefore, the distinct-redirect-URI solution is the most universal.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#37

Post by vwpolo3 »

plange wrote: post #19
vwpolo3 wrote: post #9

Earlier quoted context omitted.

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

This is NIH syndrome. You're way better off following the standards, and likely implementing standard libraries to actually make use of them.

Sorry, but following a standard for federation is not a substitute for building a log in system, which is what most people want when building "a web app".

Re: Show HN: Hydra – Open-Source OAuth2 Server

#38

Post by vwpolo3 »

manigandham wrote: post #15
vwpolo3 wrote: post #9

Earlier quoted context omitted.

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

Bringing in a library is different from building it from scratch. Pretty much every language has solid OIDC frameworks now. OIDC is great for greenfield and much better than writing user signin flow every time.

Username + Password with a cookie store is much better understood and harder to get wrong than implementing a full OIDC suite (server + client). If you're talking federated login, that's what OIDC is for. If you're talking "login", your opinion is misguided.

Re: Show HN: Hydra – Open-Source OAuth2 Server

#39

Post by KitDuncan »

vwpolo3 wrote: post #17
manigandham wrote: post #16

The Ory suite is missing the user database component. Is this still on the roadmap? The Hive project looks empty: https://github.com/ory/hive

Yes, not only on a roadmap but in high priority and under active development (not in the public eye yet)

Very exciting. Definitely will give it a try then!
Post reply on HN