Learning Digital Identity by Phil Windley is a great resource as long as you skip over the SSI parts
https://www.oreilly.com/library/view/learning-digital-identi...
Ask HN: Any comprehensive courses on Auth?
51–60 of 93 posts
Re: Ask HN: Any comprehensive courses on Auth?
#52Learning Digital Identity by Phil Windley is a great resource as long as you skip over the SSI parts https://www.oreilly.com/library/view/learning-digital-identi...
I took my CS security course from Windley. I’ve often wondered how his sovereign identity stuff is going
Re: Ask HN: Any comprehensive courses on Auth?
#53One thing I did early on, that I would highly recommend, is picking up a Security+ study guide book and reading it. I recommend a digital copy, since it's easier to ignore the fact that the book is quite large. Even if you never do the certification (I haven't), the Security+ curriculum gives a really nice broad overview of a ton of the concepts involved and how they're used practically. From there, as a few others have mentioned ,it's hard to beat reading some of the specs for Oauth2, OIDC, SAML, etc, to understand how the primitives are woven together and what the different terms mean.
Re: Ask HN: Any comprehensive courses on Auth?
#54Earlier quoted context omitted.
It depends! (I work for an auth vendor, so where I stand depends on where I sit, to some extent.) I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all. I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to: * support slack-like workspace switching functionality for…
I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.
I work on the cloud security team for a Fortune 500 company. They won’t even consider a third party service that doesn’t provide a enterprise SSO/SAML integration with our auth provider. I suspect this is the more common approach for enterprise level companies given that at 40k+ employees it’s just not possible to manage employee auth across hundreds of services.
Re: Ask HN: Any comprehensive courses on Auth?
#55What made me understand these things the most, was setting this up just for myself. For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for…
As someone interested on upskilling, can you perhaps expand on what you mean by "tinker"? I hear a lot of devs talking about "learning by doing" but I'm trapped in a tutorial hell.
Re: Ask HN: Any comprehensive courses on Auth?
#56I'm currently in the boat where I need to set up authentication (and eventually authorization) for a startup catering to big enterprises almost exclusively. I'd love to be recommended resources for setting up something like Keycloak or Auth0 (or anything else) for that use case.
Re: Ask HN: Any comprehensive courses on Auth?
#57What made me understand these things the most, was setting this up just for myself. For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for…
As someone interested on upskilling, can you perhaps expand on what you mean by "tinker"? I hear a lot of devs talking about "learning by doing" but I'm trapped in a tutorial hell.
pick an outcome you wish to achieve, break it down into subtasks, then work on them one by one.
After completing each subtask, review and re-prioritize the task list
As you go along, more tasks will come up that need to be added to the list
Edit: perhaps the hard bit is coming up with a thing to achieve? There are some examples in the other comments, such as setup xxx to auth with yyy
Re: Ask HN: Any comprehensive courses on Auth?
#58What made me understand these things the most, was setting this up just for myself. For example host your own instance of Zitadel, Authentik or whatever you find most appealing. Tinker a bit around with it. Then use that instance to authenticate yourself somewhere, i.e. another service where you can set up your own oauth provider. Take a look at the API requests, take a look the code of some OAuth implementation, for…
That’s how I’ve learned about authentication, and most other things too. I do worry, sometimes, that I’ve missed a big detail that opens my server to a vulnerability of some kind. That’s where education can help.
Re: Ask HN: Any comprehensive courses on Auth?
#59imo, the best way to learn these is to implement them on a small scale yourself. When I wanted to learn about JOSE, I implemented a JOSE library and read the RFCs alongside my implementation. It taught me a lot.
Re: Ask HN: Any comprehensive courses on Auth?
#60Earlier quoted context omitted.
As mentioned elsewhere, I'd probably start with OAuth2.1 (not quite a standard but well on its way) as this updates the OAuth2 standard, as well as consolidates lots of improvements. https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...
OAuth 2.1 has no new features. It is OAuth 2.0 rolled up with all the specs since 2.0. It is the better place to start for learning about delegated authorization.
I wonder. Do open source oauth servers actually implement all of 2.0 these days? Do clients? What do they do for the bits the spec leaves... unspecified? My memory isn't the best but I remember ten or so years ago when the spec was fresh that so-called off the shelf servers at the time didn't actually implement anything of value, so had to write my own barebones version. I remember thinking the 1.x spec was actually better, but it didn't matter anyway because every real app would just write code targeting whatever it was that social media companies were doing and calling oauth. (One notable thing was not ever presenting the user with an HTTP Basic experience, and everyone is still addicted to JSON vs. form-encoded body parameters.)