Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Obligator – An OpenID Connect server for self-hosters

github.com

Post reply on HN
Print view View original

61–70 of 134 posts

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#61

Post by TrickardRixx »

apitman wrote: post #20
benkillin wrote: post #13

This looks like exactly what I was looking for. I was looking for turnkey AuthN/AuthZ using OIDC for closed networks and self hosting, turnkey as in being able to drop a configured container in place and hit the ground running, and not being dex with keycloak.

If you're looking for something but more production ready, Authelia seems like a good option. Vouch and oauth2-proxy are even simpler but more specific in what they do. If you can provide more details of what you're trying to accomplish I might be able to give more specific advice.

I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#62

Post by snappysnap »

TrickardRixx wrote: post #61
apitman wrote: post #20

Earlier quoted context omitted.

If you're looking for something but more production ready, Authelia seems like a good option. Vouch and oauth2-proxy are even simpler but more specific in what they do. If you can provide more details of what you're trying to accomplish I might be able to give more specific advice.

I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.

How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout.

https://www.keycloak.org/docs/latest/securing_apps/

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#63

Post by hatf0 »

apitman wrote: post #46
sisve wrote: post #39

I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it? https://github.com/ory/kratos

Hydra is in the table, but you might have to scroll sideways to see it. That column also still needs to be filled out

The comparison with simply just Hydra is rather unfair too as the strength with Ory products is when they work in tandem (e.g. oathkeeper & hydra). Hydra is as barebones as you can get for a OAuth2 provider - that’s all it does & is meant to do. Stack it with Oathkeeper and you have a dynamic way of enforcing endpoint authentication that can entirely be managed using Kubernetes custom resources. Nothing I’ve found comes even close to touching the Ory stack in that regard.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#64

Post by v2223943777435 »

apitman wrote: post #60
v2223943777435 wrote: post #58

Earlier quoted context omitted.

just because email is often the defacto identity on the internet doesn't make it a good idea (bandwagon fallacy). i don't consider email tokens to be a serious form of authentication. unless you send the user their authentication secret with data encrypted by the user's public key, i strongly recommend against any use of email-based authentication. * there are a huge number of middlemen in emailing that you have to t…

There are mitigations for these security issues. The most important is that you only email the user a random code which is bound to the browser login attempt session. The user is required to enter the code they received in that session. This removes the need to trust any of the parties you listed.

you still have to trust the client device. but i guess if someone else is there you're screwed anyway.

also, email has a potential for a big delay. a lot of times people need to log in quickly. email doesn't always reach the destination in a timely manner.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#65

Post by cchance »

snappysnap wrote: post #62
TrickardRixx wrote: post #61

Earlier quoted context omitted.

I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.

How about KeyCloak? We use it for OIDC and it's feature rich with support for private key signing and back channel logout. https://www.keycloak.org/docs/latest/securing_apps/

i think most people look at keycloak, and just feel overwhelmed, but that seems to be the case for OIDC in general, they always feel insanely heavy, something like this with a flatfile config and single file executable seems pretty amazing.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#66

Post by throwaway67743 »

nitnelave wrote: post #22
throwaway67743 wrote: post #3

Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though (another thing thats lacking is a simple ldap server, perhaps with sql as db, openldap is excessive and glauth isn't there)

Have you had a look at LLDAP for a super simple LDAP backend with SQL behind? That or kanidm if you want OIDC built in.

I hadn't seen that, thanks! even has clear information on how to build natively and has a reference config

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#67

Post by JambalayaJim »

KRAKRISMOTT wrote: post #50
jupp0r wrote: post #49

Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.

If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.

There is one difference here - email reset would lock the legitimate user out of the account, whereas email magic links would not. I think that's an advantage for the former.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#68

Post by apitman »

v2223943777435 wrote: post #64
apitman wrote: post #60

Earlier quoted context omitted.

There are mitigations for these security issues. The most important is that you only email the user a random code which is bound to the browser login attempt session. The user is required to enter the code they received in that session. This removes the need to trust any of the parties you listed.

you still have to trust the client device. but i guess if someone else is there you're screwed anyway. also, email has a potential for a big delay. a lot of times people need to log in quickly. email doesn't always reach the destination in a timely manner.

The UX challenges are real, no doubt about that. That's actually one of the main reasons I started down the OIDC rabbit hole. I was using only passwordless email logins on my services, and wanted to provide my users with the UX of social login without forcing them to give up their privacy to ad companies.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#69

Post by apitman »

Phrodo_00 wrote: post #54
KRAKRISMOTT wrote: post #50

Earlier quoted context omitted.

If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.

You could let users use end to end encrypted protocols for it (like signal, telegram or supposedly whatsapp)

Yes, and I hope we get there someday, but currently that's a tiny fraction of users.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#70

Post by RealStickman_ »

TrickardRixx wrote: post #61
apitman wrote: post #20

Earlier quoted context omitted.

If you're looking for something but more production ready, Authelia seems like a good option. Vouch and oauth2-proxy are even simpler but more specific in what they do. If you can provide more details of what you're trying to accomplish I might be able to give more specific advice.

I'm looking for something that can federate identity, i.e. allow login with the @company microsoft identity provider, or support a users table, and ideally allows linking them. I just want to properly authenticate for internal tooling.

Maybe Authentik can do what you need? It supports all the various protocols as provider and consumer.
Post reply on HN