Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy to use OpenID Connect client and server library written for Go

github.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Easy to use OpenID Connect client and server library written for Go

#31

Post by kjuulh »

Lucasoato wrote: post #29
kjuulh wrote: post #4

Having built and worked with a variety of oidc implementations. It is an incredibly misused technology, while it initially can be easy to integrate into your app. It increases the complexity of the app to a surprising degree. Now suddenly your little webapp have to handle how various devices handle redirects to external sites, receives callbacks. And all the weird ways oidc implementations uses cookies, handles retur…

If you think people misuse OIDC, just imagine how much they could fail implementing a AuthN/AuthZ on their own.

What about oidc and authn+z on their own? ;)

Failure galore

Re: Easy to use OpenID Connect client and server library written for Go

#32

Post by pzmarzly »

KronisLV wrote: post #18

I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy config…

Have you considered/tried Ory Kratos + Hydra [0]? I've never used either Ory or Keycloak, but out of these 2, Keycloak feels more opinionated and harder to set up, though it does have more features.

[0] https://www.ory.sh/open-source/

Re: Easy to use OpenID Connect client and server library written for Go

#33

Post by Too »

kjuulh wrote: post #9
harha_ wrote: post #5

Earlier quoted context omitted.

how various devices handle redirects to external sites Isn't a simple redirect in the same window enough? Redirect to OIDC provider -> login -> redirect back APP -> get OIDC state from URI params?

At the most basic yes, but the protocol doesn't describe what the login part is and how that works. Often it implements session using cookies, which given the state you were in previously. Maybe you wanted to embed the login page on your own site (iframe or webview), now the cookies are flagged as third party cookies and blocked in a variety of context. Especially in an app context it becomes a minefield of half bake…

> Maybe you wanted to embed the login page on your own site (iframe or webview)

Half of the reason to use SSO is that users should not ever enter their credentials on arbitrary web sites.

Otherwise generally agree with the rest of your points. Acquiring a token from a web page and especially authentication from non browser contexts can be excruciatingly difficult. Imagine an idp only providing login through browser prompts, when you are trying to build a CLI that requires login.

Re: Easy to use OpenID Connect client and server library written for Go

#34

Post by [deleted] »

kjuulh wrote: post #4

Having built and worked with a variety of oidc implementations. It is an incredibly misused technology, while it initially can be easy to integrate into your app. It increases the complexity of the app to a surprising degree. Now suddenly your little webapp have to handle how various devices handle redirects to external sites, receives callbacks. And all the weird ways oidc implementations uses cookies, handles retur…

[deleted]

Re: Easy to use OpenID Connect client and server library written for Go

#35

Post by sureglymop »

KronisLV wrote: post #18

I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy config…

What I've always wanted from a system like this is the ability to send a one-time registration link to someone over e-mail. That would enable more controlled self registration without fully opening up registration. I never found anything like this though. If anyone knows something please let me know.

Re: Easy to use OpenID Connect client and server library written for Go

#36

Post by oglop »

Oidc and keycloak have been great for my project. We stear users to it as it also allows for user impersonation by an admin. Thi is a huge help to debug issues for users, while also keeping any authentication work out of our app and the concern oof the authentication layer.

This alone sets it apart for us. Lots of other solutions don’t offer this. And then users make requests to our software for this ability and like I tell them, there’s no way our software is going to insert itself into your authentication system. That’s for your authentication system!!

Anyway, I seem to be the minority here but maybe that’s the domain I work in.

Re: Easy to use OpenID Connect client and server library written for Go

#37

Post by _cenw »

sureglymop wrote: post #35
KronisLV wrote: post #18

I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy config…

What I've always wanted from a system like this is the ability to send a one-time registration link to someone over e-mail. That would enable more controlled self registration without fully opening up registration. I never found anything like this though. If anyone knows something please let me know.

You could build it backed by the Keycloak Admin API.

Re: Easy to use OpenID Connect client and server library written for Go

#38

Post by _cenw »

pzmarzly wrote: post #32
KronisLV wrote: post #18

I went with using Keycloak for a platform I'm developing right now and it feels like a very overcomplicated enterprise piece of software - it still does work and has the features that I need (notably: an SSO login portal, user registration, password resets and social login), but definitely needed a certain amount of time to configure correctly and had odd bugs, like me needing the following in my reverse proxy config…

Have you considered/tried Ory Kratos + Hydra [0]? I've never used either Ory or Keycloak, but out of these 2, Keycloak feels more opinionated and harder to set up, though it does have more features. [0] https://www.ory.sh/open-source/

Hydra and Kratos do not come with any frontend components, it's essentially just an API you have to write a a much more opinionated client for.

Re: Easy to use OpenID Connect client and server library written for Go

#39

Post by mynameisvlad »

_cenw wrote: post #38
pzmarzly wrote: post #32

Earlier quoted context omitted.

Have you considered/tried Ory Kratos + Hydra [0]? I've never used either Ory or Keycloak, but out of these 2, Keycloak feels more opinionated and harder to set up, though it does have more features. [0] https://www.ory.sh/open-source/

Hydra and Kratos do not come with any frontend components, it's essentially just an API you have to write a a much more opinionated client for.

Kratos does have a reference UI implementation: https://github.com/ory/kratos-selfservice-ui-node

Re: Easy to use OpenID Connect client and server library written for Go

#40

Post by johnchristopher »

I would like to become more knowledgeable about authentication and identification tech stacks (LDAP, OIDC, Oauth, CAS, etc.) and have hands-on experience. I already dabbled a bit with some LDAP, I have professional experience in administering linux boxes and intranet infrastructure. Where should I begin if I want to set up a simple homelab with maybe a raspberry and some NUC ?
Post reply on HN