Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nobody Cares About OAuth or OpenID Connect

developer.okta.com

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Nobody Cares About OAuth or OpenID Connect

#51

Post by rectalogic »

meroje wrote: post #20
simonw wrote: post #2

I'm trying to build a simple Python app that authenticates against corporate Okta right now. It's incredibly, painfully difficult. If you search for "Python Okta" you get this: https://developer.okta.com/code/python/ > At this time we do not support official API client libraries (SDKs) for Python. You may fork our legacy Python SDK or join the conversation on this thread and let us know how you’d like to use Okta fro…

Pretty much the same situation here, we just disabled 2fa today on our aws integration because the web-only flow made it impossible to use cli tools.

You don't have to use a web-only flow for MFA. We use a tool that prompts for MFA the execs any CLI with the environment setup with the STS credentials e.g. https://gist.github.com/rectalogic/e99c10bd43a2a8f6542680953...

Re: Nobody Cares About OAuth or OpenID Connect

#52

Post by hirsin »

arkh wrote: post #46
colemickens wrote: post #39

Here's my problem with OIDC and I don't know where to bring this up to find out if my hopes are widely off or I've missed something big and it already exists... There's nothing specified anywhere that allows an application to interrogate an RP about the available scopes. I just don't see how fine-grained resource access can be done with OIDC without requiring the user to grant much coarser access first. I found a dra…

And a problem for the Resource Server: no common way to check the validity of a token. You may be lucky and get a JWT but even then there's no specified URL to get the keys to check it. Usually you get an opaque token and hope the client gives you a way to know where it comes from so you can do some specific server to server call. So you can't implement an independant RS which does not care about clients and how they…

Look at the JWT, take the issuer claim, take the .well-known config off that url, and you have keys. Match that against the known permanent issuer you expected, and verify the signature of the JWT against the keys. If you're accepting things that aren't JWTs then you're not doing oauth.

Re: Nobody Cares About OAuth or OpenID Connect

#53

Post by leowoo91 »

Years ago, I did care about adding FB login for a while, until my app has been removed from approval because of some strict guidelines. I'm pretty sure it required effort to resolve. From these days, I didn't even consider adding any oauth unless good presence for the project is achieved.

Re: Nobody Cares About OAuth or OpenID Connect

#54

Post by robotdan »

tofflos wrote: post #17

I agree that the learning curve is too steep with OAuth and OpenID and that supporting multiple scenarios could be part of the problem. One specific problem I've faced is that it's very complicated to configure a development environment for unit and integration testing. I think there is huge demand for something that works well for Docker Compose and unit testing frameworks while still being a production grade soluti…

Keycloak seems to be a pretty good on-premise option. Hard to know what will come of it now that IBM bought RedHat.

If on-premise is a requirement, you may want to look at FusionAuth. On premise, runs on Mac, Linux, Windows, Docker, and Kubernetes. This should check all of your boxes, installs in a few moments with the fast path install or docker-compose up. https://fusionauth.io/

Re: Nobody Cares About OAuth or OpenID Connect

#56

Post by brokenwren »

simonw wrote: post #2

I'm trying to build a simple Python app that authenticates against corporate Okta right now. It's incredibly, painfully difficult. If you search for "Python Okta" you get this: https://developer.okta.com/code/python/ > At this time we do not support official API client libraries (SDKs) for Python. You may fork our legacy Python SDK or join the conversation on this thread and let us know how you’d like to use Okta fro…

I'm surprised no one has mentioned FusionAuth (https://fusionauth.io). It's free, has a Python library, and the features that most apps need. There are a couple of people using Python with FusionAuth right now.

The community for FusionAuth is growing quickly and it has an open issue tracker (https://github.com/FusionAuth/fusionauth-issues), good docs (https://fusionauth.io/docs/v1/tech/), and many open source projects as well (https://github.com/FusionAuth).

I'm one of the developers of FusionAuth, so you should give it a try and lot us know what you think.

Re: Nobody Cares About OAuth or OpenID Connect

#57

Post by abelhabel »

alexk wrote: post #45
simonw wrote: post #2

I'm trying to build a simple Python app that authenticates against corporate Okta right now. It's incredibly, painfully difficult. If you search for "Python Okta" you get this: https://developer.okta.com/code/python/ > At this time we do not support official API client libraries (SDKs) for Python. You may fork our legacy Python SDK or join the conversation on this thread and let us know how you’d like to use Okta fro…

My favorite identity provider of all time is https://auth0.com I was very impressed by their rules concept [1] that allowed me to create quite non-trivial authentication scheme in one day from scratch [2] They also pay attention to development workflows by having great logs and debugging tool chain as a part of their service, very cool! [1] https://auth0.com/docs/rules [2] https://gravitational.com/blog/aws-github-ss…

Auth0 do the same thing though. They make library abstractions such as "passwordless" and make it a separate authentication flow altogether, where as in reality it is just a matter of generating temporary passwords. There is no need to not be able to just enable and disable temporary passwords for any user.

Also, try implementing generation of API-key like tokens for users that can be expired, revoked, authorized etc.

Auth0 have made products that hide complexity, in my opinion, but if those products fit your particular need, sure it works great.

Re: Nobody Cares About OAuth or OpenID Connect

#58

Post by brokenwren »

unclebucknasty wrote: post #36
zxcvbn4038 wrote: post #18

The redeeming feature about OAUTH, like pretty much anything security related, is that if you don’t give people a standard to follow then you are probably going to end up with something that is insecure and poorly implemented. A lot of people just don’t have the background to do good security work, and when you try to explain why a short lived credential is good, or why we can’t have a plain text password embedded in…

> don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site This is exactly why I am paranoid about depending entirely on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The lat…

> Authentication is just too important to completely outsource without recourse

I agree 100%. You need to own your users and all of their data. Along those same lines, I wouldn't want my user data going into a multi-tenant, cloud-hosted solution like Okta. I'd much prefer to store everything on my own servers or use an on-premise solution like FusionAuth or KeyCloak.

Re: Nobody Cares About OAuth or OpenID Connect

#59

Post by brokenwren »

mevile wrote: post #32

We've started using AWS Cognito which provides social logins and oauth and even mobile client and web sdks for integrating. Writing yet another authentication system was just too much and it's great how there's services like okta and aws that are stepping up and letting people just use those and at least in the case of Cognito, at minimal cost.

I've heard that Cognito is very limited in terms of features and can be a headache to get working properly.

I haven't used Cognito, but I work for FusionAuth (https://fusionauth.io) and we have a number of developers that have switched from Cognito to FusionAuth because we cover more of their use cases outside of plain authentication.

Not sure if you have had similar experience with Cognito being limited.

Re: Nobody Cares About OAuth or OpenID Connect

#60

Post by robotdan »

SomeHacker44 wrote: post #49

I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation). Never building this infrastructure again. What a huge time saver. My company used Okta. We ended up cancelling it as it did not seem…

> We ended up cancelling it as it did not seem to offer any value whatsoever and was crazy expensive for our 300-odd users.

When you canceled Okta, did you build it in house, or was the AWS Cognito / AWS solution the replacement?

Did you look at anything on-prem like Keycloak or FusionAuth?

Post reply on HN