OAuth for the Open Web

#1

Post by buovjaga » Sat, Jul 07, 2018, 9:24 PM UTC

OAuth for the Open Web
aaronparecki.com

Re: OAuth for the Open Web

#2

Post by mattl » Sat, Jul 07, 2018, 10:10 PM UTC

Aaron is one of the cofounders (with Tantek Çelik) of the IndieWeb community.

Re: OAuth for the Open Web

#3

Post by icebraining » Sat, Jul 07, 2018, 10:29 PM UTC

I don't understand why the need for this new protocol; what's missing from OpenID?

Re: OAuth for the Open Web

#4

Post by daveid » Sat, Jul 07, 2018, 10:42 PM UTC

icebraining wrote: post #3

I don't understand why the need for this new protocol; what's missing from OpenID?

OpenID doesn't provide API access like OAuth does, does it?

Re: OAuth for the Open Web

#5

Post by lstamour » Sat, Jul 07, 2018, 10:55 PM UTC

Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.

Re: OAuth for the Open Web

#6

Post by justinsaccount » Sat, Jul 07, 2018, 11:04 PM UTC

Persona (https://en.wikipedia.org/wiki/Mozilla_Persona) had it right :(

Re: OAuth for the Open Web

#7

Post by floatboth » Sat, Jul 07, 2018, 11:05 PM UTC

daveid wrote: post #4

icebraining wrote: post #3

I don't understand why the need for this new protocol; what's missing from OpenID?

OpenID doesn't provide API access like OAuth does, does it?

Exactly, it doesn't. Instead, OpenID had tons of weird bloat no one ever needed. XRI, XRDS, Yadis, WTF

Re: OAuth for the Open Web

#8

Post by fiatjaf » Sat, Jul 07, 2018, 11:11 PM UTC

justinsaccount wrote: post #6

Persona ( https://en.wikipedia.org/wiki/Mozilla_Persona ) had it right :(

See https://portier.github.io

Re: OAuth for the Open Web

#9

Post by EGreg » Sat, Jul 07, 2018, 11:11 PM UTC

Here are some thoughts for distributed auth:

https://github.com/Qbix/auth

Re: OAuth for the Open Web

#10

Post by raarts » Sat, Jul 07, 2018, 11:11 PM UTC

daveid wrote: post #4

icebraining wrote: post #3

I don't understand why the need for this new protocol; what's missing from OpenID?

OpenID doesn't provide API access like OAuth does, does it?

From Wikipedia : "the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[82] It allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain the basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format. OpenID Connect allows a range of organizations, including web-based, mobile and JavaScript clients, to request and receive information about authenticated sessions and end-users".

My favorite implementation: Keycloak.