Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run your own OAuth2/OpenID Connect provider

github.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#11

Post by arekkas »

simplify wrote: post #9
arekkas wrote: post #7

Earlier quoted context omitted.

Thanks, however Doorkeeper is an SDK, right? With Hydra, you simply boot the docker image and are done. If you're interested in OAuth2 frameworks, check out [fosite]( https://github.com/ory-am/fosite ), which is like Doorkeeper for Go.

Doorkeeper is closer to a full-package with customizable features, including a basic frontend. I'm not too familiar with hydra, but it seems Doorkeeper is best when you want to get the full OAuth app & user interface running (and customize later), whereas Hydra is best when you want to get a quick OAuth API app and build your own frontend. Would you say this is accurate?

Yeah I think that is valid. Hydra can also be put on top of existing infrastructures. Not sure how well that is possible with Doorkeeper.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#12

Post by xenophonf »

Pyxl101 wrote: post #4

Nice! Lowering barriers to the use of technologies like these is important. Would anyone else be interested in hosting Mozilla Persona? https://developer.mozilla.org/en-US/Persona

I wonder what it's operational requirements are... and whether Mozilla is willing to hand persona.org et al over to a motivated group of volunteers.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#13

Post by arekkas »

olalonde wrote: post #8

How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there any overlap with https://getkong.org/ ?

Currently hydra issues opaque tokens but has the capabilities to switch to JWT in the future. There is a warden HTTP API endpoint that you can use to inspect tokens and use hydra's access control. I will probably add a more common token info endpoint or a OAuth2 Token Introspection endpoint ( https://tools.ietf.org/html/rfc7662 ) later on.

I haven't used kong yet but from my first impression it should be possible to use hydra together with kong.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#14

Post by andy_ppp »

Pyxl101 wrote: post #4

Nice! Lowering barriers to the use of technologies like these is important. Would anyone else be interested in hosting Mozilla Persona? https://developer.mozilla.org/en-US/Persona

I think it's a real shame about Mozilla Persona... Anyone know why it was dropped, it was always going to be one of those things that the people/organisation running it had to be in for the long term.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#15

Post by olalonde »

arekkas wrote: post #13
olalonde wrote: post #8

How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there any overlap with https://getkong.org/ ?

Currently hydra issues opaque tokens but has the capabilities to switch to JWT in the future. There is a warden HTTP API endpoint that you can use to inspect tokens and use hydra's access control. I will probably add a more common token info endpoint or a OAuth2 Token Introspection endpoint ( https://tools.ietf.org/html/rfc7662 ) later on. I haven't used kong yet but from my first impression it should be possible to…

Ok, thanks. So let's say I wanted to use Hydra for authenticating requests made to my REST API, I'd have to make an API call to Hydra on each request, right? Would be interesting to have some integration examples with popular web frameworks (e.g. Express.js, Rails, Django, etc.).

Thanks for releasing this by the way, looks really well engineered. I'm sure you've considered it already, but you could probably sell a hosted version (a la https://auth0.com) to make money and finance development.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#17

Post by simplify »

arekkas wrote: post #11
simplify wrote: post #9

Earlier quoted context omitted.

Doorkeeper is closer to a full-package with customizable features, including a basic frontend. I'm not too familiar with hydra, but it seems Doorkeeper is best when you want to get the full OAuth app & user interface running (and customize later), whereas Hydra is best when you want to get a quick OAuth API app and build your own frontend. Would you say this is accurate?

Yeah I think that is valid. Hydra can also be put on top of existing infrastructures. Not sure how well that is possible with Doorkeeper.

Doesn't the nature of an OAuth server imply that it can be added to existing infrastructures? Or is there an issue you foresee with non-Hydra libraries?

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#18

Post by scrollaway »

Pyxl101 wrote: post #4

Nice! Lowering barriers to the use of technologies like these is important. Would anyone else be interested in hosting Mozilla Persona? https://developer.mozilla.org/en-US/Persona

Check out Let's Auth:

https://github.com/letsauth/letsauth.github.io

It's a successor to Mozilla Persona in development.

Details in the readme and on freenode #letsauth (mirrored to gitter.im/letsauth/letsauth).

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#20

Post by callahad »

scrollaway wrote: post #18
Pyxl101 wrote: post #4

Nice! Lowering barriers to the use of technologies like these is important. Would anyone else be interested in hosting Mozilla Persona? https://developer.mozilla.org/en-US/Persona

Check out Let's Auth: https://github.com/letsauth/letsauth.github.io It's a successor to Mozilla Persona in development. Details in the readme and on freenode #letsauth (mirrored to gitter.im/letsauth/letsauth).

Some context: we just finished proving out OpenID Connect as a reasonable protocol for websites (seriously, there's good stuff hiding in there) and are now working on rewriting the prototypes so that they're stable and worthy of trusting. Expect an announcement in the next month, along with better documentation and on-ramps for contributors.
Post reply on HN