Must admit I've treated all my selfhosting like an coconut: Hard shell on the perimeter (firewall & wireguard)...but inside the home net its all just wide open.
[deleted]
Show HN: Obligator – An OpenID Connect server for self-hosters
41–50 of 134 posts
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#42Reminds me of https://github.com/dexidp/dex
[deleted]
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#43Personally I went with Keycloak, because it's fairly well documented and also has Docker images available: https://www.keycloak.org/getting-started/getting-started-doc... although the fact that they want you to create an "optimized" image yourself and have a long setup process on startup otherwise is slightly annoying: https://www.keycloak.org/server/containers Regardless, with something like mod_auth_openidc or anot…
[deleted]
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#44Earlier quoted context omitted.
Thanks, this is very informative. I was really hoping OIDC+WebFinger would catch on, it was a more or less equivalent experience to Mozilla's Persona, which I was a big fan of.
Thank you for mentioning Persona. I sadly missed that train when it was a thing, but it's always sounded cool. I think it's basically what I want. Comparing to it in the docs would actually probably be a good way to explain the purpose of obligator.
Persona was the best way to do identity management. Using your email address to authenticate was genius, and it worked with any email provider that would accept your email address. Even if you self-hosted, with things like name_of_site@yourdomain.com, it would still work (unlike logging in with Google, where the site gets your main email address).
I was so sad to see it die.
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#45> opinionated Love to see it
[deleted]
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#46I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it? https://github.com/ory/kratos
Hydra is in the table, but you might have to scroll sideways to see it. That column also still needs to be filled out
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#47Earlier quoted context omitted.
Some I found: - I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out. https://goauthentik.io/docs/providers/proxy/custom_headers - It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup). - Definitely offers upstream OIDC, I have my instance set up to be able to sign in through AAD or locally. htt…
> I believe it does offer trusted header auth, although I haven’t used it for any of my apps to test out Fixed, thanks. Do you know if custom headers are returned when using forward auth, or only when Authentik is acting as a proxy? > It doesn’t offer “Passwordless email login”, but offers “passwordless login” in the form of passkeys (with a tiny bit of setup). In the case of obligator, email support specifically is…
I'm fairly sure you can set custom headers with the forward auth (although I have never used it), you just have to configure it in the reverse proxy as well.
I believe you could setup email login by using the email TOTP 2FA much like I use my yubikey for passwordless authentication. You can modify the flows quite extensively... if you know what you are doing
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#48Earlier quoted context omitted.
I think I did and when I couldn't find useful installation details I gave up, I don't use docker or kubernetes, so if projects can't be bothered to make information available for a generic install, I immediately lose interest.
I do plenty of native installs, and I find Docker based instructions to be a pretty nice universal codex for how things work. Docker entryscripts sometimes have significant magic baked in (alas), but quite often Docker is a distribution mechanism more than anything else. The Docker guides are - 9 times out of 10 - more than informative enough to show how to DIY in any other of the dozens if not hundreds of other syst…
"using the easy thing"
Easy != Simple. Not everyone wants to play around with Dockerfiles, docker compose and what not. Sometimes a plain binary is preferred. I say this as someone who likes docker for certain use cases but docker is not my solution for everything.
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#49Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.
Re: Show HN: Obligator – An OpenID Connect server for self-hosters
#50Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.
If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.