Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding OAuth2 and OpenID Connect

polarsparc.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Understanding OAuth2 and OpenID Connect

#41

Post by mooreds »

bswamina wrote: post #40
mooreds wrote: post #36

This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were. I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allo…

Thank you very much for the valuable feedback ... very much appreciate and pointers ... this why love to share so can get feedback and pointers for other information may have missed.

Thanks for writing the post and helping people understand the standards better!

Re: Understanding OAuth2 and OpenID Connect

#42

Post by bswamina »

sjroot wrote: post #6

Are you implementing OAuth 2 or interested in learning more? I would highly recommend combing through the OAuth 2.1 spec [1] as it incorporates the “best practices” that were added to 2.0 through additional RFCs. [1] https://tools.ietf.org/html/draft-ietf-oauth-v2-1-00

This was for me to get the concepts clear and learn how the OAuth2 flows work. Definitely will check out the link you shared.

Re: Understanding OAuth2 and OpenID Connect

#43

Post by etimberg »

gurch101 wrote: post #33
taosx wrote: post #9

I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business) I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans. The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month. Thank you @sjroot

Have you looked at Keycloak like the article suggests? Always thought a SaaS around keycloak would be a good idea.

If you know your way around it, Keycloak is good. But it seems quite easy to get into some paint points. I was using it recently and accidentally sent something that wasn't valid JSON. Instead of a 400 return code with some kind of message you get a 500 and the server coughs up a giant stack trace.

Re: Understanding OAuth2 and OpenID Connect

#44

Post by mooreds »

mooreds wrote: post #36

This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were. I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allo…

> I think that if you need that separation between your resource servers and authorization server, ...

Ack, this should have been

I think that if you do not need that separation between your resource servers and authorization server, ...

Re: Understanding OAuth2 and OpenID Connect

#45

Post by bogomipz »

This was a really well-written post. I really liked the learn by doing approach accompanied by flow diagrams. It's easy to get lost in the weeks with OAAuth terminology and this really kept good focus. I also looked at some of the author's other posts on things Protobufs and Tries and found them similarly enjoyable. I look forward to reading future posts and hope you post them here as well.

Re: Understanding OAuth2 and OpenID Connect

#46

Post by hardwaresofton »

For those who are looking for an alternative and are OK with centralization of Auth which is somewhat different from the goals of OAuth, check out the CAS standard -- it's an alternative to SAML more so than OAuth.

It's so simple I wrote (and abandoned) a golang library that implements v1[2]. I didn't need the proxy abilities in v2 (and doubt most orgs actually do) and I use JSON in some places before it was in the standard but it was very easy to implement and thus I can say it's easy to understand. I've meant to convert the project to Rust for a long time but at this point I'll probably never get to it.

[0]: https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Spe...

[1]: https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.htm...

[2]: https://github.com/t3hmrman/casgo

Re: Understanding OAuth2 and OpenID Connect

#47

Post by different_sort »

mooreds wrote: post #36

This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were. I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allo…

Storing tokens in cookies would be against the spec wouldn’t it? I’m not putting rfc6749 on some sort of pedestal, but it clearly states that the tokens are in the response body and not set in cookies.

Do you have any examples of Authorization servers in the wild doing this or front end SDKs that work with that?

I’m very curious, I’m doing an SPA security research project at work and I’m very interested in these stories and learning more.

I’ve seen some folks do refresh in an httponly cookie, and Access in the js space. I’ve seen another example (auth0) put the refresh token in a web worker and access token accessible in js.

And I’ve seen things like msal.js just say F it and make them all accessible to js.

Re: Understanding OAuth2 and OpenID Connect

#49

Post by brujoand »

The one thing that really bugs me about the OAuth flow is what is described as step 3. When the application who wants to access data on your behalf is redirected to a login page where the user enters credentials and grants access.

In many apps, these login redirects happen inside the app window, hiding the url. And even if the URL isn’t hidden, there’s suddenly a browser window inside my app and many unconscious “security checks” fail to load.

I’d much rather have the OAuth provider send me an email or get a notification that can be actioned within the OAuth providers app so that I know I’m not giving my credentials to something that looks like the OAuth providers sign in page.

Re: Understanding OAuth2 and OpenID Connect

#50

Post by ablekh »

Would you think that, for an early-stage SaaS startup (enterprise B2B focus), the optimal strategy for implementing AuthN/AuthZ would be to use a managed service (e.g., Auth0) for MVP development and after that (perhaps, during pilots phase) migrate to an open source solution (e.g., Keycloak)?
Post reply on HN