A guide to Oauth2 • Hacker News Board

Re: A guide to Oauth2

#51

Post by ken » Mon, Sep 02, 2019, 5:43 PM UTC

What I’ve never been able to get a clear answer to is: how do I troubleshoot an Oauth workflow? I set up all the Oauth stuff on my end just as the documentation says, and the Google server (for example) returns an error. Now what? They don’t let me see their logs. The error message isn’t descriptive enough to know what to change. Google isn’t running an open source server where I can just spin up an instance myself to try it. The documentation seems to be out of date, or otherwise doesn’t match what I’m seeing.

This is everything I hate about using remote APIs, squared. I’ve never been able to make even the simplest example work.

Re: A guide to Oauth2

#52

Post by kerkeslager » Mon, Sep 02, 2019, 5:46 PM UTC

afrodc_ wrote: post #39

kerkeslager wrote: post #37

OAuth2 isn't a standard protocol. A real standard protocol is one where you can build a library around it and then use that to communicate with anyone else who conforms to the standard. OAuth2 is more of a description of the various homegrown authentication methods different websites have tried to create. None of those websites want to reimplement their auth to conform to the standards, so they just add their auth to…

Would OpenID Connect not satisfy this requirement? It's an authentication wrapper of OAuth2

I've implemented 10+ OAuth integrations, so I feel qualified to speak on that topic. I haven't implemented any OpenID integrations except one that used a library, so I don't feel qualified to comment.

Re: A guide to Oauth2

#53

Post by kevlened » Tue, Sep 03, 2019, 12:30 AM UTC

pierreyoda wrote: post #6

I'm currently in the middle of implementing an OAuth 2.0 authorization server following the RFC draft of the best current practice [1]. It's been a huge pain navigating all the interlinked (and sometimes contradicting) RFCs around, especially with a distinct lack of resources for actually implementing an authorization server. RFC6749 does not suffice on its own since it says nothing about authentication or tokens pay…

This is a great exercise. It's really fulfilling to learn a spec by implementing.

I've used @panva's certified [0] js provider [1] and client [2] for many use cases. Is there a reason (aside from learning) to reimplement the spec? If you do, you may consider getting your implementation certified to expand the list!

[0] https://openid.net/developers/certified/ [1] https://github.com/panva/node-oidc-provider [2] https://github.com/panva/node-openid-client

Re: A guide to Oauth2

#54

Post by apatheticonion » Tue, Sep 03, 2019, 12:38 AM UTC

My experience using OpenID + OAuth2 was fantastic. I'd recommend delegating the responsibility of authentication to a third party like Cognito, Auth0 or Okta.

They can be pricey at scale, but as long as you follow the protocol without cramming more functionality into authentication than belongs there, you can swap them out for a self hosted solution.

Re: A guide to Oauth2

#55

Post by perl4ever » Tue, Sep 03, 2019, 2:31 AM UTC

ken wrote: post #51

What I’ve never been able to get a clear answer to is: how do I troubleshoot an Oauth workflow? I set up all the Oauth stuff on my end just as the documentation says, and the Google server (for example) returns an error. Now what? They don’t let me see their logs. The error message isn’t descriptive enough to know what to change. Google isn’t running an open source server where I can just spin up an instance myself t…

I was trying to use Oauth to log in to an internal SharePoint site with VBA, and I did get some example code to work after a lot of messing around, but then it mysteriously stopped working a week later,* so I gave up and went back to scripting a browser.

*possibly because some system administrator noticed abnormal traffic and blocked it