Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 174 posts

Re: OAuth for all

#81

Post by throw1234567891 »

dist-epoch wrote: post #60
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

I run Codex in multiple disposable sandboxes and OAuth is such a fucking pain. I vibe-coded a project which just stores/allocates/shuffles codex auth.json files around. I have a codex instance that I manually authenticate multiple times with browser OAuth, then copy that auth.json in a store from where it's distributed to the sandboxes. And sandbox codex sometimes refreshes the authorization, so when that happens I n…

What does codex's auth.json file have to do with OAuth?

Re: OAuth for all

#82

Post by throw1234567891 »

v5v3 wrote: post #70

"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability." [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0] https://github.com/ory [1] https://www.keycloak.org/

Keycloak.

Re: OAuth for all

#83

Post by nijave »

breakingcups wrote: post #58
utopiah wrote: post #35

Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.

Cloudflare is one of the most expensive providers out there once you step out of the basics. Look at their video streaming.

Maybe it depends on product offering. WAF + CDN was competitive with Akamai (through a VAR) and AWS and came with free Zero Trust seats.

Iirc Argo and some other routing products are quite expensive.

Re: OAuth for all

#84

Post by khurs »

aeneas_ory wrote: post #76
v5v3 wrote: post #70

"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability." [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0] https://github.com/ory [1] https://www.keycloak.org/

KeyCloak is great if you want a full stack Java server to run internal workforce for example, but Ory is much better at running high scale (eg at OpenAI https://www.ory.com/case-studies/openai ) and in a composable fashion. Yes we have an commercial version because how else can one finance world class open source powering the biggest software names on the planet? It‘s a good thing that Ory has a business model that w…

Valid points (although Keycloak was Redhat not IBM and then donated by them to CNCF), but should "security SLAs for CVEs" be listed as a premium feature?

Looked at the case study, uses Cockroach which is now commercial, so potentially with the dual costs of Ory and Cockroach licenses, unless you need massive scale, would be too expensive for small/medium and also startups? Unless your sole focus is on enterprises?

And Keycloak also has such a implementation https://www.cockroachlabs.com/blog/deploying-keycloak-on-coc...

Re: OAuth for all

#85

Post by RealCodingOtaku »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Slight tangent.

The only way to preserve privacy while having a central and easy authentication mechanism I can think of is to use IndieAuth[0] which is built on top of OAuth 2.0.

Of course, you will need to be your own provider, using an IndieAuth provider service defeats the purpose, which is what I see most IndieWeb devs are doing.

You will need to own a (sub)domain though.

[0] https://indieweb.org/IndieAuth?redirected=IndieAuth

Re: OAuth for all

#86

Post by aeneas_ory »

khurs wrote: post #84
aeneas_ory wrote: post #76

Earlier quoted context omitted.

KeyCloak is great if you want a full stack Java server to run internal workforce for example, but Ory is much better at running high scale (eg at OpenAI https://www.ory.com/case-studies/openai ) and in a composable fashion. Yes we have an commercial version because how else can one finance world class open source powering the biggest software names on the planet? It‘s a good thing that Ory has a business model that w…

Valid points (although Keycloak was Redhat not IBM and then donated by them to CNCF), but should "security SLAs for CVEs" be listed as a premium feature? Looked at the case study, uses Cockroach which is now commercial, so potentially with the dual costs of Ory and Cockroach licenses, unless you need massive scale, would be too expensive for small/medium and also startups? Unless your sole focus is on enterprises? An…

My mistake - I thought it‘s now just under the IBM corp but it is indeed in CNCF. Still, IBM offers a commercial product around KeyCloak.

If you serve 900m weekly active users, you need this type of distributed database architecture that is expensive to run. But at that point the cost of running it is a fraction of overall infra spend. No start up really needs this level of scale, only Enterprises (hence it‘s gated). Making Cockroach work is more work than just wiring up the SQL, you actually need to deal with it like dynamodb under the hood and use primary keys efficiently, avoid hotspots, and all that jazz.

Most companies (like Cloudflare!) do just fine with Postgres and one of our services. Ory Hydra is written in Go, doesn’t need JVM, very little RAM, doesn’t need caches or start up time due to cold starts. The architecture is different and that makes it cheap and fast to run. From the blog post - they run Hydra on 0.6 vCPU and 200MB of RAM. That’s probably as cheap as it gets!

It‘s a different tool for a different problem than KeyCloak - both have their place.

Re: OAuth for all

#87

Post by hvb2 »

matja wrote: post #80
jurgenaut23 wrote: post #17

Earlier quoted context omitted.

I am tempted to agree with you because I could never quite wrap up my head around it, but I never had to implement OAuth beyond a brief skim through the doc for my own understanding. I always thought this complexity was there for some good reason (security?).

OAuth is designed so that an end-user never needs to see an API key (OAuth refresh/access token) or even know what one is. When it is implemented to the spec, that happens well. I think that most of the "just give me an API key" comments are from a <1% of end-users (developers) that know what an API key is, and are facing a broken OAuth implementation.

> and are facing a broken OAuth implementation.

Or didn't bother to read the spec to understand why it's non trivial. Things like this are complex because attacks will force it to be.

Also, the broken implementation might be an OIDC implementation that doesn't support client_credentials for example. Seen that many times and that does make it rather awkward to implement a server to server flow...

Re: OAuth for all

#88

Post by khurs »

aeneas_ory wrote: post #86
khurs wrote: post #84

Earlier quoted context omitted.

Valid points (although Keycloak was Redhat not IBM and then donated by them to CNCF), but should "security SLAs for CVEs" be listed as a premium feature? Looked at the case study, uses Cockroach which is now commercial, so potentially with the dual costs of Ory and Cockroach licenses, unless you need massive scale, would be too expensive for small/medium and also startups? Unless your sole focus is on enterprises? An…

My mistake - I thought it‘s now just under the IBM corp but it is indeed in CNCF. Still, IBM offers a commercial product around KeyCloak. If you serve 900m weekly active users, you need this type of distributed database architecture that is expensive to run. But at that point the cost of running it is a fraction of overall infra spend. No start up really needs this level of scale, only Enterprises (hence it‘s gated).…

Yes, Java based is never going to be as good as a more modern language like Go

Re: OAuth for all

#89

Post by [deleted] »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

[deleted]

Re: OAuth for all

#90

Post by the8472 »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

OIDC can be relatively straight-forward (that is just a few JSON REST calls) if the provider isn't configured in a restrictive way. The .well-known/openid-configuration endpoint is quite helpful. Exchanging username+password (optionally with OTP) for a token is an option in the standard. The issue is that lots of deployments are quite restrictive "for security".
Post reply on HN