Ask HN: Sign Up with Facebook/Apple/Google – API or OAuth? • Hacker News Board

Ask HN: Sign Up with Facebook/Apple/Google – API or OAuth?

#1

Post by brittpart_ » Sun, Dec 27, 2020, 10:19 PM UTC

What is this technology called? An API, OAuth? I'm trying to do some research on how this works but I'm not sure what I should be researching.

Re: Ask HN: Sign Up with Facebook/Apple/Google – API or OAuth?

#2

Post by cuu508 » Sun, Dec 27, 2020, 10:28 PM UTC

They don't always make it obvious, but it is usually OAuth2, sometimes with tweaks

Re: Ask HN: Sign Up with Facebook/Apple/Google – API or OAuth?

#3

Post by noodlesUK » Sun, Dec 27, 2020, 10:34 PM UTC

Social login and SSO is generally implemented these days as OIDC (which is based on oauth2). You can read the RFCs for it, and they pretty much explain the whole thing.

Oauth2: https://tools.ietf.org/html/rfc6749

PKCE (replaces the implicit flow): https://tools.ietf.org/html/rfc7636

OIDC: https://openid.net/specs/openid-connect-core-1_0.html

Re: Ask HN: Sign Up with Facebook/Apple/Google – API or OAuth?

#4

Post by brittpart_ » Sun, Dec 27, 2020, 11:58 PM UTC

noodlesUK wrote: post #3

Social login and SSO is generally implemented these days as OIDC (which is based on oauth2). You can read the RFCs for it, and they pretty much explain the whole thing. Oauth2: https://tools.ietf.org/html/rfc6749 PKCE (replaces the implicit flow): https://tools.ietf.org/html/rfc7636 OIDC: https://openid.net/specs/openid-connect-core-1_0.html

So essentially the UI is called SSO and the authentication happens with Oauth2/OIDC - that's the combo Apple uses.

Do you know what the barrier to entry is for a company to integrate another company's SSO?