4 ms·

https://persowna.net/ https://persowna.net/ it's still alive, no need to fork. It's going to suffer the same problem as OpenID though. I.e., with no big vendor

https://persowna.net/ https://persowna.net/ it's still alive, no need to fork. It's going to suffer the same problem as OpenID though. I.e., with no big vendor behind it, you have even less of a chance of having hitting that 'critical mass' point where people will integrate it into their applications. https://news.ycombinator.com/item?id=10789556 https://news.ycombinator.com/item?id=10789556 Discussed here further. Like with OpenID, the problem is vendors remove support for OpenID. Right now there's a very, VERY good standard made by OASIS (standards body on par with IEEE/ISO/W3C)- SAML, which with a YubiKey[4] and a cell phone app for managing permissions gives you a really nice setup. The flow is basically plug-in your YubiKey off your key-chain, then authenticate once when you log-in at the start of the day, anything that implements SAML will now give you a SSO (similar to AD/LDAP) but it's two tokened with a focus of ease of use for Joe Blow (as simple as a Push notification to your phone (authentication comparment #3) saying "App Foo is asking for permission for you to log in. <Slide left/right for approve/deny> while giving you granular control for the power user. Again, chicken egg adoption problem, but its the most elegant I've seen. https://wiki.oasis-open.org/security/FrontPage https://wiki.oasis-open.org/security/FrontPage http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-... http://saml.xml.org/wiki/idp-initiated-single-sign-on-post-binding http://saml.xml.org/wiki/idp-initiated-single-sign-on-post-b... [4] https://www.yubico.com/2015/10/github-yubico-u2f/ https://www.yubico.com/2015/10/github-yubico-u2f/

TazeTSchnitzel 11y ago
Persowna.net isn't a Persona fork. It's just a way to set up your own domain so Persona asks it to authenticate users directly.
djsumdog 11y ago
I implemented a SAML2 IDP once when I worked at a University using Shibboleth (as both the IDP and SP). SAML2 has a lot of heavy usage in academia or between industry systems. That being said, there were a lot of exceptions and rules that needed to be put into place for the plethora of broken SAML2 implementations. Some needed an attribute in two scopes, others had trouble with certain OIDs, etc. The Shibboleth mailing list is filled with things like, "oh if you're trying to connect to someone using Oracle SSO, add x y and z because their stuff is hopelessly broken." I mean for the most part, it did just work. I see it as great when you want to build trust relationships, but in the general case, I think OpenID was simpler and better. I still run my own OpenID. It gets me into ... StackExchange. It no longer works with Slashdot, gitorious, freecode and many other sites that have either stopped supporting it or gone under. Oh wait, it works with OpenStreetMaps too.
- iheartmemcache 11y ago
  Yeah, my experience is precisely the same re: OpenID. Is that SAML2 IdP code open? Things have..slowly... improved within the SAML2 ecosystem, but if you've found a better alternative (SSO for the average Joe - preferably with 2FA a la YubiKey) let me know.
  - thaeli 11y ago
    SimpleSAMLphp is quite straightforward; use the Yubikey auth source and you get their 2FA very easily. SAML2 will never be quite as easy to configure as OpenID in practice, but it's the least painful setup I've seen. (Yes, I include several of the big commercial authentication-as-a-service vendors in that comparison.) Having the ability to easily manipulate attributes at a per-SP level makes integrating with semi-broken vendor implementations much more practical. There are modules available to add OpenID and OAuth; I use the OpenID module in production and have been quite happy with it.
technion 11y ago
critical mass As an example, I setup an NTP server a while back and found they used Bitcard.org as an authentication manager. I've been using it for years now and aside from the note on their website about running much of Perl.org, I've never heard of it being used anywhere else. It's probably a reasonable service but I'd never implement it on my website because I know I'd be telling customers to go off and setup a Bitcard account, which they would have never heard of.
- deleted 11y ago
  [deleted]

TazeTSchnitzel 11y ago

Persowna.net isn't a Persona fork. It's just a way to set up your own domain so Persona asks it to authenticate users directly.

djsumdog 11y ago

I implemented a SAML2 IDP once when I worked at a University using Shibboleth (as both the IDP and SP). SAML2 has a lot of heavy usage in academia or between industry systems. That being said, there were a lot of exceptions and rules that needed to be put into place for the plethora of broken SAML2 implementations. Some needed an attribute in two scopes, others had trouble with certain OIDs, etc. The Shibboleth mailing list is filled with things like, "oh if you're trying to connect to someone using Oracle SSO, add x y and z because their stuff is hopelessly broken." I mean for the most part, it did just work. I see it as great when you want to build trust relationships, but in the general case, I think OpenID was simpler and better. I still run my own OpenID. It gets me into ... StackExchange. It no longer works with Slashdot, gitorious, freecode and many other sites that have either stopped supporting it or gone under. Oh wait, it works with OpenStreetMaps too.

iheartmemcache 11y ago
Yeah, my experience is precisely the same re: OpenID. Is that SAML2 IdP code open? Things have..slowly... improved within the SAML2 ecosystem, but if you've found a better alternative (SSO for the average Joe - preferably with 2FA a la YubiKey) let me know.
- thaeli 11y ago
  SimpleSAMLphp is quite straightforward; use the Yubikey auth source and you get their 2FA very easily. SAML2 will never be quite as easy to configure as OpenID in practice, but it's the least painful setup I've seen. (Yes, I include several of the big commercial authentication-as-a-service vendors in that comparison.) Having the ability to easily manipulate attributes at a per-SP level makes integrating with semi-broken vendor implementations much more practical. There are modules available to add OpenID and OAuth; I use the OpenID module in production and have been quite happy with it.

technion 11y ago

critical mass As an example, I setup an NTP server a while back and found they used Bitcard.org as an authentication manager. I've been using it for years now and aside from the note on their website about running much of Perl.org, I've never heard of it being used anywhere else. It's probably a reasonable service but I'd never implement it on my website because I know I'd be telling customers to go off and setup a Bitcard account, which they would have never heard of.

deleted 11y ago
[deleted]