41–50 of 80 posts
I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Ev…
This seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" butto…
The battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
This seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" butto…
Earlier quoted context omitted.
The battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
Google and Microsoft are two big companies supporting OIDC.
This seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" butto…
The battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Ev…
Gluu is just a facade company that's recompiling it from source and distributing the binaries for free.
It supports pretty much everything you can dream of, including different password hashing and you can write your own plugins to interface with anything you like.
However it's a very complicated product. It's for a large company or a country with a dedicated team to run and customize.
P.S. Not affiliated to any of these companies. I had to do the performance assessment of these products some year ago for a government contract. https://thehftguy.com/2015/10/14/iam-benchmarks-openam-vs-ws...
Earlier quoted context omitted.
Shibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
I'll give just Shibboleth a try later. I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
If you're doing that for a small company, maybe try to get a Microsoft active directory instead. It's a lot easier to setup and maintain and everything does their best to integrate with it.
Why not OpenID Connect? Not only does it have discovery for OAuth2 endpoints, it also specifies how to discovery the OIDC endpoint from a bare domain and username via WebFinger. It also has extensions for dynamic client registration, supports flows that work with input-restricted clients, as well as single page apps, and the UserInfo endpoint. And it's also already implemented and supported in lots of places. There a…
> Why not OpenID Connect? Someone asked that in the comments of the article and the author responded with this link: https://indieweb.org/indieauth-vs-openid-connect The answer seems to boil down to IndieAuth being more decentralized.
Earlier quoted context omitted.
Google and Microsoft are two big companies supporting OIDC.
But not the extensions the GP cites as meaning OIDC solves the same problem. And even if they did, I don't think it allows to isolate your identity from the identity provider you currently use, which seems to be a key aspect of IndieAuth: You can delegate the role of Identity Provider to a third party, but can change that third party, similar to how you could in "original" OpenID.
OAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation attacks. MasterCard uses OAuth 1.0a instead of 2.0 https://developer.mastercard.com/blog/why-mastercard-doesnt-...
Thus OAuth 2.0 supports both authorization and authentication. However providers are free to pick what features they want to provide to clients.