When is OAuth2 and Open ID Connect Useful?
1–10 of 18 posts
Re: When is OAuth2 and Open ID Connect Useful?
#2I'd rather use an over engineered solution that has lots of libraries available for implementation than to build a home baked auth solution that's based off of ignorance.
Re: When is OAuth2 and Open ID Connect Useful?
#3I'd rather use an over engineered solution that has lots of libraries available for implementation than to build a home baked auth solution that's based off of ignorance.
Did...did you read the article at all? The author, A. Has written successful Oauth2/OpenID libraries, B. Has built businesses atop them, C. Has still seen a lot of people misuse them, and D. Is recommending libraries that are narrower in scope, not homegrown auth solutions.
Re: When is OAuth2 and Open ID Connect Useful?
#4Can't agree more with this article! How I see it, the trend is to have different servers for the front and the back and to link them with OIDC, but that's so painfull to implement and with lot of downsides for only a few benefits (at least with the back in .Net, I don't know about other).
Re: When is OAuth2 and Open ID Connect Useful?
#5The current state of authentication consumes massive amounts of time, money and effort on any given development platform. The author's advice is great, but Oauth2 is absolutely not the end state for distributed identity, and the new thing can't come soon enough.
Re: When is OAuth2 and Open ID Connect Useful?
#6I'd rather use an over engineered solution that has lots of libraries available for implementation than to build a home baked auth solution that's based off of ignorance.
The author specifically mentions being an oauth provider. What you're apparently ranting against is "why not be an oauth consumer?" Nobody has an issue with that. (And the article explicitly states "oauth consumer? This is irrelevant to you")
Re: When is OAuth2 and Open ID Connect Useful?
#7There's quite some cargo cult – e.g. jwt and oauth2 often appear like that, when a simpler design is discarded because 'that's the way'.
If you can design a system without accounts (shortly here on HN), you won't miss oauth2.
Re: When is OAuth2 and Open ID Connect Useful?
#8I'd rather use an over engineered solution that has lots of libraries available for implementation than to build a home baked auth solution that's based off of ignorance.
> based off of ignorance
what ignorance?
Re: When is OAuth2 and Open ID Connect Useful?
#9Puh the article has the same problem as auth always has: lots and lots of magic words which are hard to remember what one word exactly means.
We just use keycloak everywhere and I don't know if our setup uses oauth, sso, jwt,oauth2, open id, saml etc.
Keycloak library works, configuring Google as an additional provider is easy.
I trust that setup but it would be great if we would just have one thing with x features and everyone supports it.
You want to connect Fe with be? Use a.
You need API token/auth, use b.
You want to allow auth from ext? Use c.
What I will not do though, auth as a service. I add Google and co because the customer is thrusting them.
Re: When is OAuth2 and Open ID Connect Useful?
#10(New?) title of article is a little less evocative:
> Why you probably do not need OAuth2 / OpenID Connect