Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run your own OAuth2/OpenID Connect provider

github.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#21

Post by callahad »

xenophonf wrote: post #12
Pyxl101 wrote: post #4

Nice! Lowering barriers to the use of technologies like these is important. Would anyone else be interested in hosting Mozilla Persona? https://developer.mozilla.org/en-US/Persona

I wonder what it's operational requirements are... and whether Mozilla is willing to hand persona.org et al over to a motivated group of volunteers.

We never got Persona past the point of needing an external script on websites pointing to the Persona domain. We really don't want to risk anyone getting XSS'd or assume transitive trust in whomever would follow Mozilla in custodianship of the domain, so we plan to kill the service, destroy all user data, and maintain ownership of the domain for many years.

Also, Persona was pretty explicitly designed in a way that assumed eventual, native integration into browsers. IMHO, any successor without the backing of a browser vendor would be better served by starting from scratch with a different set of assumptions. :)

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#23

Post by sakopov »

olalonde wrote: post #8

How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there any overlap with https://getkong.org/ ?

You have to query token validation endpoint to have your reference token validated. That's how oauth2 works. With OpenId connect you get JWT which can be validated without a call to the identity provider.

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#27

Post by arekkas »

simplify wrote: post #17
arekkas wrote: post #11

Earlier quoted context omitted.

Yeah I think that is valid. Hydra can also be put on top of existing infrastructures. Not sure how well that is possible with Doorkeeper.

Doesn't the nature of an OAuth server imply that it can be added to existing infrastructures? Or is there an issue you foresee with non-Hydra libraries?

No, Hydra works with every existing solution :) You can read more on this topic in the guide: https://ory-am.gitbooks.io/hydra/content/oauth2.html

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#28

Post by arekkas »

olalonde wrote: post #15
arekkas wrote: post #13

Earlier quoted context omitted.

Currently hydra issues opaque tokens but has the capabilities to switch to JWT in the future. There is a warden HTTP API endpoint that you can use to inspect tokens and use hydra's access control. I will probably add a more common token info endpoint or a OAuth2 Token Introspection endpoint ( https://tools.ietf.org/html/rfc7662 ) later on. I haven't used kong yet but from my first impression it should be possible to…

Ok, thanks. So let's say I wanted to use Hydra for authenticating requests made to my REST API, I'd have to make an API call to Hydra on each request, right? Would be interesting to have some integration examples with popular web frameworks (e.g. Express.js, Rails, Django, etc.). Thanks for releasing this by the way, looks really well engineered. I'm sure you've considered it already, but you could probably sell a ho…

Depends, if you use JWT you can cryptographically verify that the token and the token claims are valid. Right now, Hydra does not issue JWTs but it would be easy as pie to add that functionality.

Writing an integration guide for this is a very good idea. Hydra's APIs are validating all requests using that technique, but it's not documented.

Auth0.com is pretty cool, they have done some cool projects that help OAuth developers. However, they are overpriced imho. Hosting hydra is definitely something I will consider. Thanks! :)

Re: Show HN: Run your own OAuth2/OpenID Connect provider

#30

Post by arekkas »

ClayM wrote: post #24

Would this or coreos/dex replace something like Auth0?

Auth0 has a lot of integrations and features that dex/hydra do not have. Auth0 have their own Identity Provider, which hydra does not. But in general you can say that dex/hydra have a very similar featureset to Auth0
Post reply on HN