I agree that setting up federated identity isn't as easy as you'd like, but that doesn't mean saying "OAuth sucks!" is okay when a) it's OpenID Connect in this

I agree that setting up federated identity isn't as easy as you'd like, but that doesn't mean saying "OAuth sucks!" is okay when a) it's OpenID Connect in this case and b) he's not really talking about anything that's in the spec, it's setting up with one provider with the wrong tools to do so. There are safe AND simple systems, and you pay per user or per authentication to those companies that provide them. It's security, there's no one-click solution, you've gotta do it properly (which can include paying someone to do it properly for you). Google's OpenID Connect documentation [1] is pretty good, and for the steps that involve code in your application, there's very likely a library [2][3] that does it for you. It'd probably take you a day to put something together without existing knowledge, and then you've got secure federated login using an open industry standard that you can easily extend to add other identity providers. [1] https://developers.google.com/identity/protocols/OpenIDConnect?hl=en https://developers.google.com/identity/protocols/OpenIDConne... [2] http://openid.net/developers/libraries/ http://openid.net/developers/libraries/ [3] http://jwt.io http://jwt.io