Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Obligator – An OpenID Connect server for self-hosters

github.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#111

Post by apitman »

langur wrote: post #96
BodyCulture wrote: post #93

Earlier quoted context omitted.

Which not? Thank you!

ZITADEL doesn't support anonymous clients. Honestly, it's not the best practice anyway. As for Forward Auth, the concept can be a bit fuzzy, and from what I gather, ZITADEL doesn't really support that. Trusted Header Auth might work in some scenarios, but that definition is also a bit fuzzy, so hard to say for sure.

> ZITADEL doesn't support anonymous clients. Honestly, it's not the best practice anyway.

How would you accomplish the same thing using best practices? The closest is dynamic client registration without requiring an initial access token, but that still requires clients to support the protocol, and I know at least the Jellyfin and Discourse OIDC plugins do not. And even if they did what do you gain over anonymous auth?

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#112

Post by apitman »

Wronnay wrote: post #89

Cool, but I looks like the creator didn't really look deep in the competition. Many of the question marks in the comparison table can be replaced by a checkmark.

I looked more closely at the simpler ones, since simplicity was a baseline requirement for me when I went looking for a server to meet my needs. If the docs for something were too complicated to even determine if it supported the features I need then I tended not to spend much time digging through them.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#113

Post by apitman »

omneity wrote: post #25
camsjams wrote: post #12

Earlier quoted context omitted.

This did indeed work for Google (that's the only one I tried), but the details of how this works is best detailed in this post: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web The above post was also linked from the obligator project's GH readme

IndieAuth is super super cool and a vital component to get back control of the internet to users, but I can't shake up the security concerns. Also, near the end of the article. Using a security nightmare such as Wordpress as your identity provider, what could go wrong? It only takes one single rogue plugin.

What security concerns specifically?

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#114

Post by apitman »

hkt wrote: post #86

Genius. Not having to register is brilliant and I love it. I'll be watching this project and using it.

Just to be clear I was not the one to come up with anonymous client auth. This comes from the IndieAuth/IndieWeb community, and I link to Aaron Parecki's article[0] describing it in the repo.

That said, IndieAuth isn't OIDC and obligator may be the first OIDC implementation that uses these concepts.

[0]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#115

Post by lakomen »

apitman wrote: post #105
lakomen wrote: post #100

Question about this indie auth thing, or anonymous clients, mentioned at the linked page. Wouldn't that effectively grant access to your user data to everyone, regardless of their intentions? Meta, for instance, has very strict TOS and privacy policy checks before approving a client_id. And those checks are on-going. https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

What user data are you referring to? One problem with comparing to social login providers is that their OAuth2 APIs tend to provide a lot more access than just OIDC, which greatly increases the risk of phishing and other attacks. Since a simple OIDC server like obligator only deals with identity, the worst case scenario of a phishing attack is that the user's email address is exposed to the attacker. You can think of…

What user data? User data... idk how else to put it.

Account data. Usernames, emails, pictures, group memberships, roles. User data.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#116

Post by lakomen »

neonsunset wrote: post #110
lakomen wrote: post #99

Earlier quoted context omitted.

I use keycloak, but it's Java and I need Go or better performance. With the new UI mass admin tasks are no longer possible. At least version upgrades are better now. Keycloak has no ed25519 support. Louketo proxy or whatever it's called nowadays only supports RS256, so I had to write my own OIDC middleware. At least they stopped generating UUIDv4 secrets. Hydra is too complex. Dex is too simple. Identity Server lacks…

Go or better performance so...C# or Java? :)

troll much?

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#117

Post by apitman »

ffo wrote: post #108
apitman wrote: post #106

Earlier quoted context omitted.

The race really does seem to be between ZITADEL and Ory for the next generation of OIDC servers. Any chance of sqlite support in the future?

I think both products could even coexist ;-) SQLlite would be super nice, but we lack engineering capacity right now to get that done.

> I think both products could even coexist

Fair enough, but developers and sysadmins don't want to choose between two great options. They want one obvious best option and a second option that is good enough and can be made better if option one turns evil.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#118

Post by apitman »

lakomen wrote: post #115
apitman wrote: post #105

Earlier quoted context omitted.

What user data are you referring to? One problem with comparing to social login providers is that their OAuth2 APIs tend to provide a lot more access than just OIDC, which greatly increases the risk of phishing and other attacks. Since a simple OIDC server like obligator only deals with identity, the worst case scenario of a phishing attack is that the user's email address is exposed to the attacker. You can think of…

What user data? User data... idk how else to put it. Account data. Usernames, emails, pictures, group memberships, roles. User data.

Right, I wasn't sure if you were referring specifically to the user's profile information on the OIDC server, the other user data stored by the same entity which runs the OIDC server (which is common but not the case for obligator because it's identity-only), or the user's data on the app that they're trying to log into.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#119

Post by apitman »

throwaway67743 wrote: post #109
BodyCulture wrote: post #94

Earlier quoted context omitted.

apt install more easy and with auto updates safe! Docker too complicated, networking, security, dependencies, all messy after all these years. Apt rules!

Podman makes this better, as it doesn't trash my ipt/nft rules in the process, and its essentially stateless amongst other useful things

How's the network performance on podman? It defaults to slirp4netns right?

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#120

Post by throwaway67743 »

apitman wrote: post #119
throwaway67743 wrote: post #109

Earlier quoted context omitted.

Podman makes this better, as it doesn't trash my ipt/nft rules in the process, and its essentially stateless amongst other useful things

How's the network performance on podman? It defaults to slirp4netns right?

Probably for user containers, but I've only ran it as root generally to avoid those sorts of limitations so haven't noticed any issues - I rarely use docker and only use for quick testing and then switch to non-docker installs
Post reply on HN