71–80 of 134 posts
Earlier quoted context omitted.
Hydra is in the table, but you might have to scroll sideways to see it. That column also still needs to be filled out
The comparison with simply just Hydra is rather unfair too as the strength with Ory products is when they work in tandem (e.g. oathkeeper & hydra). Hydra is as barebones as you can get for a OAuth2 provider - that’s all it does & is meant to do. Stack it with Oathkeeper and you have a dynamic way of enforcing endpoint authentication that can entirely be managed using Kubernetes custom resources. Nothing I’ve found co…
Earlier quoted context omitted.
Yes, and I hope we get there someday, but currently that's a tiny fraction of users.
Whatsapp has like 3 billions users. Not exactly tiny.
The main problem is that it's not federated and completely under Facebook's control. Also, identity based on WhatsApp is still vulnerable to simjacking, correct?
Earlier quoted context omitted.
Some I found: - I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out. https://goauthentik.io/docs/providers/proxy/custom_headers - It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup). - Definitely offers upstream OIDC, I have my instance set up to be able to sign in through AAD or locally. htt…
> I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out Fixed, thanks. Do you know if custom headers are returned when using forward auth, or only when Authentik is acting as a proxy? > It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup). In the case of obligator, email support specifically is…
Very well might’ve been, the mobile view of the table isn’t fantastic so it was quite a bit of scrolling; definitely could have messed that up.
> In the case of obligator, email support specifically is important. Passkeys are really cool, but unless I'm mistaken there's no way for me to say "give the owner of this passkey access to this data" even if they've never yet logged in to your system.
No, the user would need to enroll it. They could use a social login (upstream OIDC) without logging in through customizations, you can pre-create their user or create it on demand and give it appropriate access based on the upstream response. I don’t think you could implement magic links, even as customizable as it is.
Earlier quoted context omitted.
Whatsapp has like 3 billions users. Not exactly tiny.
Huh, I honestly didn't know it was that big. Forgive my ignorance, I've never really used Whatsapp. Can you send a message to someone that hasn't added you as a contact? If so I would seriously consider implementing this as an alternative to email. The main problem is that it's not federated and completely under Facebook's control. Also, identity based on WhatsApp is still vulnerable to simjacking, correct?
Yes to both
I know the Authelia team is hard at working supporting some of the use cases that are currently not supported, so I will probably wait until some things are implemented there instead of switching.
Earlier quoted context omitted.
I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.
How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout. https://www.keycloak.org/docs/latest/securing_apps/
Earlier quoted context omitted.
I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.
Maybe Authentik can do what you need? It supports all the various protocols as provider and consumer.