I know that maintaining a OAUth provider is a pain in the ass, not at all doable by anyone.
OAuth for the Open Web
11–20 of 80 posts
Re: OAuth for the Open Web
#12Here are some thoughts for distributed auth: https://github.com/Qbix/auth
Too much about what it does, zero about _how_.
Re: OAuth for the Open Web
#13Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.
The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything.
Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.
Re: OAuth for the Open Web
#14Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.
The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything. Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.
Browsers could implement that part of the UI. Like address autofill.
Re: OAuth for the Open Web
#15Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.
Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.
Re: OAuth for the Open Web
#16Why not OpenID Connect? Not only does it have discovery for OAuth2 endpoints, it also specifies how to discovery the OIDC endpoint from a bare domain and username via WebFinger. It also has extensions for dynamic client registration, supports flows that work with input-restricted clients, as well as single page apps, and the UserInfo endpoint.
And it's also already implemented and supported in lots of places. There are tools like Dex that offer OIDC and can use "upstream" OIDC providers for the actual user management.
I'm not getting why IndieAuth is needed beyond what OIDC offers?
Also, for those mentioning Persona/BrowserID/Portier, it is an OpenID Connect provider, and I've just recently sent PRs for it and Dex that allow them to work together.
Re: OAuth for the Open Web
#17Earlier quoted context omitted.
The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything. Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.
Browsers could implement that part of the UI. Like address autofill.
And until then what do we do?
Re: OAuth for the Open Web
#18Re: OAuth for the Open Web
#19Why not OpenID Connect? Not only does it have discovery for OAuth2 endpoints, it also specifies how to discovery the OIDC endpoint from a bare domain and username via WebFinger. It also has extensions for dynamic client registration, supports flows that work with input-restricted clients, as well as single page apps, and the UserInfo endpoint. And it's also already implemented and supported in lots of places. There a…
> Why not OpenID Connect?
Someone asked that in the comments of the article and the author responded with this link:
https://indieweb.org/indieauth-vs-openid-connect
The answer seems to boil down to IndieAuth being more decentralized.
Re: OAuth for the Open Web
#20I know that maintaining a OAUth provider is a pain in the ass, not at all doable by anyone.
Do you mean to say it is impossible or do you mean something like the more idiomatic "by just anyone"?