10 ms·

Run your own OAuth2 server

235 points by machete143 9y ago

machete143 9y ago
If you're not into reading the article itself and want to check out the technology first, here's the link to github: https://github.com/ory/hydra https://github.com/ory/hydra If you have any questions, feel free to ask ahead.
ourcat 9y ago
Worth adding to this that Wordpress have been working on an official OAuth1.0a server plugin for while alongside the development of the new REST API. It works well. I've built an iOS app on the back of it. (1.0a was chosen due to WP not wanting to enforce https.) https://en-gb.wordpress.org/plugins/rest-api-oauth1/ https://en-gb.wordpress.org/plugins/rest-api-oauth1/ I've also seen discussion on an official OAuth2 server plugin, what with the rapid increase of https sites, thanks to the likes of LetsEncrypt. There's a well supported OAuth2.0 server plugin here: https://en-gb.wordpress.org/plugins/oauth2-provider/ https://en-gb.wordpress.org/plugins/oauth2-provider/ But you'd be wise to only run it via https.
- machete143 9y ago
  Yes indeed, running OAuth2 without https is madness!
  - unilynx 9y ago
    It's not just madness, TLS is a MUST in several places in the oauth2 spec. In fact, they managed to remove a lot of oauth1 madness (all the complex signing stuff) by simply requiring TLS and let that layer deal with it.
andreareina 9y ago
> Please use more secure values in production. ;) That's not going to stop people from using those exact values. How many breaches have we seen due to the lack of sane defaults? Tutorial code (especially when written by the people putting out the software) is a default, and it's likely to result in plenty of people running this exact code in production.
- machete143 9y ago
  That is a valid concern. However, once a password is published (especially in docs or tutorials) it is insecure whether they are random values or not - simply because they are public and clearly linked to the product you're running. That's why I chose to make it explicit, and thus more likely to be caught in review if done.
  - dalore 9y ago
    One solution could be the app/service could have some dummy passwords built in which you can use for tutorials but it will refuse to use them if supplied.
    - machete143 9y ago
      Good point, Hydra does this to for things like missing TLS encryption but not yet for secrets (it only rejects secrets that are too short). I've tracked this here: https://github.com/ory/hydra/issues/573 https://github.com/ory/hydra/issues/573
      - hxtk 9y ago
        It seems like the simplest thing, then, would be to use a secret that is too short in your documentation and make note of both the fact that it's too short and what the requirements are for a good secret. Of course, this runs the risk that a user will simply "salt" the sample you provide up to the necessary length, which makes the length of their secret effectively the difference between the minimum length and the sample length.
  - tempay 9y ago
    I'd suggest using something like: export SYSTEM_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1) echo "SYSTEM_SECRET is $SYSTEM_SECRET"
    - machete143 9y ago
gallerdude 9y ago
I already have a hard time with OAuth Client!
- machete143 9y ago
  Then I hope that this makes your life easier :)
- clintonb 9y ago
  What problems are you facing? Practically every language I have worked in has a third-party library for dealing with OAuth 2.0.
  - gallerdude 9y ago
    I was trying to make it work in Unity with reddit stuff...
StavrosK 9y ago
Isn't the "problem" with this that you can't get arbitrary websites to talk to your OAuth2 server? For example, even though, say, Gitlab, supports OAuth2 login with Github, I can't get it to authenticate with stavros.io. This is the problem Portier (https://portier.github.io/ https://portier.github.io/) and OIDC aim to solve, ie to be able to auth on any website with an auth instance you run. I love this idea because it's much easier to secure one thing whose sole purpose is authentication than to secure every thing you want to authenticate on.
- koffiezet 9y ago
  In my mind, this would mostly be to have OAuth2 on your own server, allowing self-managed combined with external authentication sources like github.
- machete143 9y ago
  I'm not sure if I understood you correctly. Delegation of authentication usually implies trust between the two parties. GitLab (the hosted version) does probably not trust stravros.io enough to allow people to log in through there. Portier looks indeed very nice, maybe I'll set up a tutorial how to get those two working together to get full Authentication (portier) + Authorization (Hydra) with using only open source technology.
  - icebraining 9y ago
    Why does Gitlab have to trust anyone? It's the user that has to trust stravros.io not to tell Gitlab that other people are authorized. It's no different than a regular email/password (with password recovery): if I register with user@stravros.io, then that email server becomes empowered to give access to the Gitlab account to anyone it wants. But that's not Gitlab's problem. See also OpenID.
    - StavrosK 9y ago
      Exactly, and OpenID connect adds an authentication layer over OAuth2 for this exact purpose. If we manage to build that future, it will be very useful and quite exciting, at least to me. There won't be compromised passwords any longer, just the one password you can easily change.
manigandham 9y ago
Also worth mentioning IdentityServer: https://identityserver.io/ https://identityserver.io/
richardknop 9y ago
Interesting work. Especially for me as I have spend a lot of time delving into OAuth2 spec during my career and I have my own competing solution :) See it here: https://github.com/RichardKnop/go-oauth2-server https://github.com/RichardKnop/go-oauth2-server Available as docker container. You can simply deploy it via docker-compose up. Yours seem to be better maintained though :)
- machete143 9y ago
  Looks interesting, does this solve authentication as well? It looks like it but from quickly scanning through the readme I didn't find anything. Also what's your reasoning for relying on 4 (etcd, consul, postgres, nats) external dependencies?
  - richardknop 9y ago
    Hi, you can use resource owner password credentials grant which is part of OAuth2 spec: https://github.com/RichardKnop/go-oauth2-server#resource-owner-password-credentials https://github.com/RichardKnop/go-oauth2-server#resource-own... It's basically a login with username and password. If you want a fully fledged identity provider on top of OAuth2 (so create / update user account, password reset), I have a sample project which extends on the oauth2 repository and builds a full identity provider on top of it: https://github.com/RichardKnop/example-api https://github.com/RichardKnop/example-api About dependencies: only two are required - etcd/consul and postgres. There is no other requirements. Originally I developed this project while deploying to a CoreOS cluster so etcd was a native choice for storing app configuration in a distributed key store. Consul support was added later in form of a contribution as an alternative to etcd. I also want to remove dependency on etcd/consul completely and allow just simple configuration via environment variables to make the projec more portable.
    - machete143 9y ago
      What I meant to ask is if this has things like user registration, password reset flow, two-factor authentication, account takeover prevention, etc. I think removing 3rd party dependencies is always a good idea - it keeps things lean and removes ops overhead.
EtienneK 9y ago
Worth mentioning Keycloak as well: http://www.keycloak.org/ http://www.keycloak.org/ I've been playing around with it recently and it seems to be a very capable OIDC/Oauth2 provider indeed.
- tokenizerrr 9y ago
  Indeed, it's excellent. I'm using it with an ldap back end for my companys internal infra. Unfortunately it doesn't support u2f as a 2nd factor yet, just totp codes. That's the only thing I can think of as critique for keycloak, so it's pretty damn good.
  - willow9886 9y ago
    Gluu Server supports U2F out of the box: https://gluu.org/docs/ce/authn-guide/U2F/ https://gluu.org/docs/ce/authn-guide/U2F/ Installation instructions: https://gluu.org/docs/ce/installation-guide/ https://gluu.org/docs/ce/installation-guide/
    - tokenizerrr 9y ago
      Last time I looked at gluu it seemed massive, requiring a beefy server dedicated to running it. It came with an ldap server etc, meaning I seemingly couldn't us my own. I'll have to revisit, but last I checked its way too much. All I need is an openid server.
      - willow9886 9y ago
        It includes an LDAP server to persist all the data generated by the service. You can integrate your own backend LDAP server using the cache refresh feature: https://gluu.org/docs/ce/admin-guide/user-management/#ldap-synchronization https://gluu.org/docs/ce/admin-guide/user-management/#ldap-s... It is pretty beefy though, built for enterprise use cases.
        tokenizerrr 9y ago
kennydude 9y ago
If you're using Django, Python Social Auth tends to go a good job at this without any extra servers.
- deleted 9y ago
  [deleted]
- clintonb 9y ago
  PSA is a collection of authentication clients for authenticating with third-party auth providers (e.g. Google, Facebook, Microsoft). If you want to run your own auth provider server, you will need another library. We use Django OAuth Toolkit (https://github.com/evonove/django-oauth-toolkit https://github.com/evonove/django-oauth-toolkit) at edX.
tinco 9y ago
Is not running Postgres in Docker in production still a thing? What kind of problems are people running into? I love having everything managed using the same deployment techniques and I was on a team that ran Postgres in Docker in production for a couple of years and never ran into trouble. Of course that doesn't mean anything so I am curious.
- _ix 9y ago
  I'd like to know, too! I'm working on a side project and aiming to run containerized docker for production – can anyone weigh in?
  - whatnotests 9y ago
    Did you write the code? Do you plan to release new versions of the software over time? Is the service stateless? Great. Use Docker. If the answer to those questions is "no" then don't use Docker. That's my rule of thumb.
  - XorNot 9y ago
    It's advice born from people who don't quite understand docker. Postgres in containers just needs a data volume on a dedicated drive for speed, and you need to remember dockers default stop behaviour hard kills after 10s which is not long enough for a clean shutdown (use docker kill to send sigterm and wait).
- raziel2p 9y ago
  I have to imagine it's about how bad a crash would affect you. If you can make hourly backups and the data loss is not a huge deal, I don't see why you wouldn't, but for more important stuff just go the extra mile and get some VMs.
  - tinco 9y ago
    Why would you have data loss? Why would crashes be worse than when Postgres is not run in a Docker container? In our project we ran a master/slave Postgres setup and hourly backups. I don't fully remember the details, but as far as I know that's as safe as you can get regardless of Docker.
rawfan 9y ago
If you're looking to add an OAuth2 server to your PHP app, check out Laravel Passport (https://laravel.com/docs/5.5/passport https://laravel.com/docs/5.5/passport).
homakov 9y ago
If your sole purpose is authentication w/o authorization, one should use securelogin.pw which does not depend on identity provider. And btw OAuth2 spec is insecure by design, it's a known fact.
- ForHackernews 9y ago
  > btw OAuth2 spec is insecure by design, it's a known fact. OAuth2 is only "insecure" in that it relies on TLS for its security: the same as HTTP, IMAP or SMTP. You should never run OAuth2 over a non-HTTPS (i.e. HTTP) connection. The same is true for any other login system. This is covered in RFC 6819: https://tools.ietf.org/html/rfc6819 https://tools.ietf.org/html/rfc6819
  - homakov 9y ago
    Not just that, a couple of other bad decisions that caused made many websites inherently insecure https://sakurity.com/oauth https://sakurity.com/oauth
    - ForHackernews 9y ago
      At a glance, this looks like a proprietary re-invention of of https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-05 https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-...
    - machete143 9y ago
      That is a really bad specification with no examples, no formalization, and zero references. However, all server-side attack scenarios listed there are not possible with Hydra. Some of them also boil down to misusing OAuth2 for authentication, which is why we have OpenID Connect.
      - homakov 9y ago
        No, ignore the spec (it's just a list of traits i'd like to suggest), design issues are outlined after it.
krullie 9y ago
I've been jumping between hydra and dex for the last couple of weeks. On the one hand I like the tight focus hydra has, with the exception of the warden api. On the other hand it is really involved to simply setup a working environment that includes hydra ready to go. It would be nice to do all the token, client and policy setup using a simple docker-compose up. Dex for example has a dev mode doing that for you. The downside of Dex is you cannot use your own backend without forking the project, writing your own login page and creating a custom connector for your existing login system.
- machete143 9y ago
  Thank you for the valuable feedback! The dev mode is indeed a very good idea - I'll probably spin up another docker-compose example with all the default things set up. Would that make it easier?
  - krullie 9y ago
    Yes definitely. Although you could build a new image based off of the original one, add a bash script that sets it all up for you and overwrite the entrypoint i never like that sollution. It should be something that the software supports out of the box as it plays into one of the strengths of docker, easily spinning up and taking down instances.
raarts 9y ago
Worth mentioning: login.gov
zrail 9y ago
SAML doesn't get enough love. Big big companies want to use your software but really need to use their existing SAML-compatible identity provider. When you don't support it they'll move on to someone who can. Conversely, if your organization has a SAML-compatible IdP you get to work with a vast sea of compatible software without really having to think about the integration. Exchange metadata URLs, maybe some URL templates, and you're done.
ernsheong 9y ago
Unfortunately Hydra does not (and will not) support the resource owner password credentials (ROPC) grant (https://github.com/ory/hydra/pull/297#issuecomment-294282671 https://github.com/ory/hydra/pull/297#issuecomment-294282671) I'm no security expert, but to my understanding the ROPC grant makes sense for highly privileged applications, i.e. 1st party client applications (e.g. main app website, main native iOS client) as explained by http://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html http://oauthlib.readthedocs.io/en/latest/oauth2/grants/passw... I've been looking around in this space for OAuth and auth out of the box alternatives. I've tried Kong's OAuth2 plugin (https://getkong.org/plugins/oauth2-authentication/ https://getkong.org/plugins/oauth2-authentication/) but after trying to integrate it felt like I had to write more code than necessary. Also had to configure a lot of APIs, and felt like it was clunky to manage them that way. I have also tried to play with http://anvil.io http://anvil.io, but the authors are busy with another project (https://solid.mit.edu https://solid.mit.edu) so Anvil is taking a back seat. Even the Getting Started currently has known unfixed issues. I am heavily investigating http://www.keycloak.org/ http://www.keycloak.org/, and so far I am really impressed. However though, to deploy you will need to delve into Wildfly/Java configurations. And of course, minimum 512MB to run any Java app on a node. Dex is also advertised as a solution but it looks like the documentation could do with more information and improvements. https://github.com/coreos/dex https://github.com/coreos/dex Doesn't seem easy to just take and run. Thanks to comments here, I might these looking at these next: 1. https://github.com/RichardKnop/go-oauth2-server https://github.com/RichardKnop/go-oauth2-server 2. https://portier.github.io/ https://portier.github.io/

235 points by machete143 9y ago

If you're not into reading the article itself and want to check out the technology first, here's the link to github: https://github.com/ory/hydra https://github.com/ory/hydra If you have any questions, feel free to ask ahead.

ourcat 9y ago

Worth adding to this that Wordpress have been working on an official OAuth1.0a server plugin for while alongside the development of the new REST API. It works well. I've built an iOS app on the back of it. (1.0a was chosen due to WP not wanting to enforce https.) https://en-gb.wordpress.org/plugins/rest-api-oauth1/ https://en-gb.wordpress.org/plugins/rest-api-oauth1/ I've also seen discussion on an official OAuth2 server plugin, what with the rapid increase of https sites, thanks to the likes of LetsEncrypt. There's a well supported OAuth2.0 server plugin here: https://en-gb.wordpress.org/plugins/oauth2-provider/ https://en-gb.wordpress.org/plugins/oauth2-provider/ But you'd be wise to only run it via https.

machete143 9y ago
Yes indeed, running OAuth2 without https is madness!
- unilynx 9y ago
  It's not just madness, TLS is a MUST in several places in the oauth2 spec. In fact, they managed to remove a lot of oauth1 madness (all the complex signing stuff) by simply requiring TLS and let that layer deal with it.

andreareina 9y ago

> Please use more secure values in production. ;) That's not going to stop people from using those exact values. How many breaches have we seen due to the lack of sane defaults? Tutorial code (especially when written by the people putting out the software) is a default, and it's likely to result in plenty of people running this exact code in production.

machete143 9y ago
That is a valid concern. However, once a password is published (especially in docs or tutorials) it is insecure whether they are random values or not - simply because they are public and clearly linked to the product you're running. That's why I chose to make it explicit, and thus more likely to be caught in review if done.
- dalore 9y ago
  One solution could be the app/service could have some dummy passwords built in which you can use for tutorials but it will refuse to use them if supplied.
  - machete143 9y ago
    Good point, Hydra does this to for things like missing TLS encryption but not yet for secrets (it only rejects secrets that are too short). I've tracked this here: https://github.com/ory/hydra/issues/573 https://github.com/ory/hydra/issues/573
    - hxtk 9y ago
      It seems like the simplest thing, then, would be to use a secret that is too short in your documentation and make note of both the fact that it's too short and what the requirements are for a good secret. Of course, this runs the risk that a user will simply "salt" the sample you provide up to the necessary length, which makes the length of their secret effectively the difference between the minimum length and the sample length.
- tempay 9y ago
  I'd suggest using something like: export SYSTEM_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1) echo "SYSTEM_SECRET is $SYSTEM_SECRET"
  - machete143 9y ago

gallerdude 9y ago

I already have a hard time with OAuth Client!

machete143 9y ago
Then I hope that this makes your life easier :)
clintonb 9y ago
What problems are you facing? Practically every language I have worked in has a third-party library for dealing with OAuth 2.0.
- gallerdude 9y ago
  I was trying to make it work in Unity with reddit stuff...

StavrosK 9y ago

Isn't the "problem" with this that you can't get arbitrary websites to talk to your OAuth2 server? For example, even though, say, Gitlab, supports OAuth2 login with Github, I can't get it to authenticate with stavros.io. This is the problem Portier (https://portier.github.io/ https://portier.github.io/) and OIDC aim to solve, ie to be able to auth on any website with an auth instance you run. I love this idea because it's much easier to secure one thing whose sole purpose is authentication than to secure every thing you want to authenticate on.

koffiezet 9y ago
In my mind, this would mostly be to have OAuth2 on your own server, allowing self-managed combined with external authentication sources like github.
machete143 9y ago
I'm not sure if I understood you correctly. Delegation of authentication usually implies trust between the two parties. GitLab (the hosted version) does probably not trust stravros.io enough to allow people to log in through there. Portier looks indeed very nice, maybe I'll set up a tutorial how to get those two working together to get full Authentication (portier) + Authorization (Hydra) with using only open source technology.
- icebraining 9y ago
  Why does Gitlab have to trust anyone? It's the user that has to trust stravros.io not to tell Gitlab that other people are authorized. It's no different than a regular email/password (with password recovery): if I register with user@stravros.io, then that email server becomes empowered to give access to the Gitlab account to anyone it wants. But that's not Gitlab's problem. See also OpenID.
  - StavrosK 9y ago
    Exactly, and OpenID connect adds an authentication layer over OAuth2 for this exact purpose. If we manage to build that future, it will be very useful and quite exciting, at least to me. There won't be compromised passwords any longer, just the one password you can easily change.

manigandham 9y ago

Also worth mentioning IdentityServer: https://identityserver.io/ https://identityserver.io/

richardknop 9y ago

Interesting work. Especially for me as I have spend a lot of time delving into OAuth2 spec during my career and I have my own competing solution :) See it here: https://github.com/RichardKnop/go-oauth2-server https://github.com/RichardKnop/go-oauth2-server Available as docker container. You can simply deploy it via docker-compose up. Yours seem to be better maintained though :)

machete143 9y ago
Looks interesting, does this solve authentication as well? It looks like it but from quickly scanning through the readme I didn't find anything. Also what's your reasoning for relying on 4 (etcd, consul, postgres, nats) external dependencies?
- richardknop 9y ago
  Hi, you can use resource owner password credentials grant which is part of OAuth2 spec: https://github.com/RichardKnop/go-oauth2-server#resource-owner-password-credentials https://github.com/RichardKnop/go-oauth2-server#resource-own... It's basically a login with username and password. If you want a fully fledged identity provider on top of OAuth2 (so create / update user account, password reset), I have a sample project which extends on the oauth2 repository and builds a full identity provider on top of it: https://github.com/RichardKnop/example-api https://github.com/RichardKnop/example-api About dependencies: only two are required - etcd/consul and postgres. There is no other requirements. Originally I developed this project while deploying to a CoreOS cluster so etcd was a native choice for storing app configuration in a distributed key store. Consul support was added later in form of a contribution as an alternative to etcd. I also want to remove dependency on etcd/consul completely and allow just simple configuration via environment variables to make the projec more portable.
  - machete143 9y ago
    What I meant to ask is if this has things like user registration, password reset flow, two-factor authentication, account takeover prevention, etc. I think removing 3rd party dependencies is always a good idea - it keeps things lean and removes ops overhead.

EtienneK 9y ago

Worth mentioning Keycloak as well: http://www.keycloak.org/ http://www.keycloak.org/ I've been playing around with it recently and it seems to be a very capable OIDC/Oauth2 provider indeed.

tokenizerrr 9y ago
Indeed, it's excellent. I'm using it with an ldap back end for my companys internal infra. Unfortunately it doesn't support u2f as a 2nd factor yet, just totp codes. That's the only thing I can think of as critique for keycloak, so it's pretty damn good.
- willow9886 9y ago
  Gluu Server supports U2F out of the box: https://gluu.org/docs/ce/authn-guide/U2F/ https://gluu.org/docs/ce/authn-guide/U2F/ Installation instructions: https://gluu.org/docs/ce/installation-guide/ https://gluu.org/docs/ce/installation-guide/
  - tokenizerrr 9y ago
    Last time I looked at gluu it seemed massive, requiring a beefy server dedicated to running it. It came with an ldap server etc, meaning I seemingly couldn't us my own. I'll have to revisit, but last I checked its way too much. All I need is an openid server.
    - willow9886 9y ago
      It includes an LDAP server to persist all the data generated by the service. You can integrate your own backend LDAP server using the cache refresh feature: https://gluu.org/docs/ce/admin-guide/user-management/#ldap-synchronization https://gluu.org/docs/ce/admin-guide/user-management/#ldap-s... It is pretty beefy though, built for enterprise use cases.
      - tokenizerrr 9y ago

kennydude 9y ago

If you're using Django, Python Social Auth tends to go a good job at this without any extra servers.

deleted 9y ago
[deleted]
clintonb 9y ago
PSA is a collection of authentication clients for authenticating with third-party auth providers (e.g. Google, Facebook, Microsoft). If you want to run your own auth provider server, you will need another library. We use Django OAuth Toolkit (https://github.com/evonove/django-oauth-toolkit https://github.com/evonove/django-oauth-toolkit) at edX.

tinco 9y ago

Is not running Postgres in Docker in production still a thing? What kind of problems are people running into? I love having everything managed using the same deployment techniques and I was on a team that ran Postgres in Docker in production for a couple of years and never ran into trouble. Of course that doesn't mean anything so I am curious.

_ix 9y ago
I'd like to know, too! I'm working on a side project and aiming to run containerized docker for production – can anyone weigh in?
- whatnotests 9y ago
  Did you write the code? Do you plan to release new versions of the software over time? Is the service stateless? Great. Use Docker. If the answer to those questions is "no" then don't use Docker. That's my rule of thumb.
- XorNot 9y ago
  It's advice born from people who don't quite understand docker. Postgres in containers just needs a data volume on a dedicated drive for speed, and you need to remember dockers default stop behaviour hard kills after 10s which is not long enough for a clean shutdown (use docker kill to send sigterm and wait).
raziel2p 9y ago
I have to imagine it's about how bad a crash would affect you. If you can make hourly backups and the data loss is not a huge deal, I don't see why you wouldn't, but for more important stuff just go the extra mile and get some VMs.
- tinco 9y ago
  Why would you have data loss? Why would crashes be worse than when Postgres is not run in a Docker container? In our project we ran a master/slave Postgres setup and hourly backups. I don't fully remember the details, but as far as I know that's as safe as you can get regardless of Docker.

rawfan 9y ago

If you're looking to add an OAuth2 server to your PHP app, check out Laravel Passport (https://laravel.com/docs/5.5/passport https://laravel.com/docs/5.5/passport).

homakov 9y ago

If your sole purpose is authentication w/o authorization, one should use securelogin.pw which does not depend on identity provider. And btw OAuth2 spec is insecure by design, it's a known fact.

ForHackernews 9y ago
> btw OAuth2 spec is insecure by design, it's a known fact. OAuth2 is only "insecure" in that it relies on TLS for its security: the same as HTTP, IMAP or SMTP. You should never run OAuth2 over a non-HTTPS (i.e. HTTP) connection. The same is true for any other login system. This is covered in RFC 6819: https://tools.ietf.org/html/rfc6819 https://tools.ietf.org/html/rfc6819
- homakov 9y ago
  Not just that, a couple of other bad decisions that caused made many websites inherently insecure https://sakurity.com/oauth https://sakurity.com/oauth
  - ForHackernews 9y ago
    At a glance, this looks like a proprietary re-invention of of https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-05 https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-...
  - machete143 9y ago
    That is a really bad specification with no examples, no formalization, and zero references. However, all server-side attack scenarios listed there are not possible with Hydra. Some of them also boil down to misusing OAuth2 for authentication, which is why we have OpenID Connect.
    - homakov 9y ago
      No, ignore the spec (it's just a list of traits i'd like to suggest), design issues are outlined after it.

krullie 9y ago

I've been jumping between hydra and dex for the last couple of weeks. On the one hand I like the tight focus hydra has, with the exception of the warden api. On the other hand it is really involved to simply setup a working environment that includes hydra ready to go. It would be nice to do all the token, client and policy setup using a simple docker-compose up. Dex for example has a dev mode doing that for you. The downside of Dex is you cannot use your own backend without forking the project, writing your own login page and creating a custom connector for your existing login system.

machete143 9y ago
Thank you for the valuable feedback! The dev mode is indeed a very good idea - I'll probably spin up another docker-compose example with all the default things set up. Would that make it easier?
- krullie 9y ago
  Yes definitely. Although you could build a new image based off of the original one, add a bash script that sets it all up for you and overwrite the entrypoint i never like that sollution. It should be something that the software supports out of the box as it plays into one of the strengths of docker, easily spinning up and taking down instances.

raarts 9y ago

Worth mentioning: login.gov

zrail 9y ago

SAML doesn't get enough love. Big big companies want to use your software but really need to use their existing SAML-compatible identity provider. When you don't support it they'll move on to someone who can. Conversely, if your organization has a SAML-compatible IdP you get to work with a vast sea of compatible software without really having to think about the integration. Exchange metadata URLs, maybe some URL templates, and you're done.

ernsheong 9y ago

Unfortunately Hydra does not (and will not) support the resource owner password credentials (ROPC) grant (https://github.com/ory/hydra/pull/297#issuecomment-294282671 https://github.com/ory/hydra/pull/297#issuecomment-294282671) I'm no security expert, but to my understanding the ROPC grant makes sense for highly privileged applications, i.e. 1st party client applications (e.g. main app website, main native iOS client) as explained by http://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html http://oauthlib.readthedocs.io/en/latest/oauth2/grants/passw... I've been looking around in this space for OAuth and auth out of the box alternatives. I've tried Kong's OAuth2 plugin (https://getkong.org/plugins/oauth2-authentication/ https://getkong.org/plugins/oauth2-authentication/) but after trying to integrate it felt like I had to write more code than necessary. Also had to configure a lot of APIs, and felt like it was clunky to manage them that way. I have also tried to play with http://anvil.io http://anvil.io, but the authors are busy with another project (https://solid.mit.edu https://solid.mit.edu) so Anvil is taking a back seat. Even the Getting Started currently has known unfixed issues. I am heavily investigating http://www.keycloak.org/ http://www.keycloak.org/, and so far I am really impressed. However though, to deploy you will need to delve into Wildfly/Java configurations. And of course, minimum 512MB to run any Java app on a node. Dex is also advertised as a solution but it looks like the documentation could do with more information and improvements. https://github.com/coreos/dex https://github.com/coreos/dex Doesn't seem easy to just take and run. Thanks to comments here, I might these looking at these next: 1. https://github.com/RichardKnop/go-oauth2-server https://github.com/RichardKnop/go-oauth2-server 2. https://portier.github.io/ https://portier.github.io/