Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding OAuth2 and OpenID Connect

polarsparc.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Understanding OAuth2 and OpenID Connect

#31

Post by user5994461 »

ayewo wrote: post #14
sjroot wrote: post #11

Earlier quoted context omitted.

Nice, good luck! My advice would be to offer something very opinionated to limit the chance that something is rolled out incorrectly. That and preventing lock-in are two big requirements IMO. I’m doing something somewhat similar, happy to exchange notes.

What do you think of an open core security product like https://fusionauth.io/ that supports those protocols ?

There is no market for that.

1) Most of the work around authentication is integrations (get the app to integrate with whatever authentication protocol/database). Integration is not a product, it's consulting services.

2) There are very established products for authentication servers. See Microsoft ADFS, PingIdentity and ForgeRock on premise. See Okta and auth0 on SaaS.

3) If you're going to roll some authentication as a company, you stick to Microsoft ADFS for internal employees or to Google/Facebook auth for external accounts. You need them anyway so there is absolutely no point in getting something else. (Yes, your company is gonna use microsoft windows internally and your customer will request google auth support).

4) There is absolutely no point for yet another product. What is it gonna do? It's gonna sit on top of google auth so you can integrate with it rather than with google? Pointless, might as well integrate to google/microsoft directly.

5) Where there is money is in consulting services, libraries and plugins. For examples make a plugin for apache/nginx/haproxy to use google auth, so developers can just put that in front of their service (legacy application) and it's mostly plug and play. Or easy library for python/java/whatever to integrate (developer can just configure a google id and URL and can retrieve user info). It's hard though because of customization hell, every use case wants to do things slightly differently.

That's my 2 cents working in the industry. For reference I've worked on authentication in startups for customers, in government projects for citizens and in companies for 100k+ employees.

Re: Understanding OAuth2 and OpenID Connect

#32

Post by user5994461 »

candiddevmike wrote: post #23
deathanatos wrote: post #22

Earlier quoted context omitted.

> May be worth mentioning--JWTs are not part of the OAuth /OIDC standard. JWTs are a part of the OIDC standard; from the standard itself[1], > The primary extension that OpenID Connect makes to OAuth 2.0 to enable End-Users to be Authenticated is the ID Token data structure. The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, an…

My bad, yes I meant only OAuth.

You were correct though, JWT was not part of the OIDC standard. JWT was created separately and added retroactively later as the standard token format.

Re: Understanding OAuth2 and OpenID Connect

#33

Post by gurch101 »

taosx wrote: post #9

I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business) I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans. The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month. Thank you @sjroot

Have you looked at Keycloak like the article suggests? Always thought a SaaS around keycloak would be a good idea.

Re: Understanding OAuth2 and OpenID Connect

#34

Post by taosx »

gurch101 wrote: post #33
taosx wrote: post #9

I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business) I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans. The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month. Thank you @sjroot

Have you looked at Keycloak like the article suggests? Always thought a SaaS around keycloak would be a good idea.

Even through Keycloak is more mature than ORY ecosystem I went with the latter as I have more experience with Go than Java. I'm only writing integration, dashboard. When those thing are ready I'm going to open source and offer a free option until I add billing, at that point you can either go on-premise or just continue with us.

Ory will probably offer a cloud service in the near future but I'm just scratching an itch for now.

Re: Understanding OAuth2 and OpenID Connect

#35

Post by taosx »

the_arun wrote: post #27
taosx wrote: post #9

I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business) I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans. The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month. Thank you @sjroot

We too are building a SaaS product with billing over OAuth2. Here is our product page - https://formfly.intuit.com . We are not using OIDC. What are you building @taosx? and how are you using OIDC?

I'm building a suite of services around automotive. Due to legislation and types of consumers they're separate (different domain/branding), so SSO.

Just dropped my job in order to catch up with everything I wanted to learn and what better way than to build a business.

Currently I'm a bit (1 month) behind the schedule cause I complicated everything in order to learn k8s, rust, web assembly, svelte/sapper...so much fun, on the other side I burned through my finances a little too fast so I might need a job soon.

Re: Understanding OAuth2 and OpenID Connect

#36

Post by mooreds »

This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were.

I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allow outside access to your systems, I'd suggest using an OAuth server (disclosure, I work for FusionAuth, a free as in beer competitor to Keycloak, Gluu, etc).

Additional things that I wish had been in the article:

* Don't use implicit flow, use the authorization code grant with PKCE.

* Don't use resource owner password flow; it was designed to allow existing systems to bridge into OAuth and shouldn't be used in new systems today.

Both the implicit flow and the resource owner password flow are not part of OAuth 2.1--here's a post I wrote about it: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1

* Also, storing access tokens should be done carefully in the browser (httponly, secure cookies is the best way). If you can't do that, then use a server side proxy to store the access tokens. Otherwise your access tokens might get stolen by code executing in the browser.

* OIDC is built on top of OAuth and has a standard set of claims. If you can get by on what OIDC defines, you can switch between identity provider implementations fairly easily.

Re: Understanding OAuth2 and OpenID Connect

#37

Post by mooreds »

taosx wrote: post #18
ayewo wrote: post #14

Earlier quoted context omitted.

What do you think of an open core security product like https://fusionauth.io/ that supports those protocols ?

Open core..wouldn't that mean the core product being open source..from what I'm seeing on github only some components are open source. By that example I would also call auth0 open core. Anyways, seems interesting.

I work for FusionAuth. It's not open core. It's the other way around (open shell?), as you see, @taosx. The docs, client libraries, example apps, and some supporting libs are Apache licensed, but the core is not.

We do have a forever free community offering[0], but that's free as in beer, not as in speech.

I think it's a great product (that's part of why I joined the company) but don't want any confusion about that.

[0]: https://fusionauth.io/pricing has a list of the options.

Re: Understanding OAuth2 and OpenID Connect

#40

Post by bswamina »

mooreds wrote: post #36

This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were. I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allo…

Thank you very much for the valuable feedback ... very much appreciate and pointers ... this why love to share so can get feedback and pointers for other information may have missed.
Post reply on HN