5 ms·

I'm not sure if I understood you correctly. Delegation of authentication usually implies trust between the two parties. GitLab (the hosted version) does probabl

I'm not sure if I understood you correctly. Delegation of authentication usually implies trust between the two parties. GitLab (the hosted version) does probably not trust stravros.io enough to allow people to log in through there. Portier looks indeed very nice, maybe I'll set up a tutorial how to get those two working together to get full Authentication (portier) + Authorization (Hydra) with using only open source technology.

icebraining 9y ago
Why does Gitlab have to trust anyone? It's the user that has to trust stravros.io not to tell Gitlab that other people are authorized. It's no different than a regular email/password (with password recovery): if I register with user@stravros.io, then that email server becomes empowered to give access to the Gitlab account to anyone it wants. But that's not Gitlab's problem. See also OpenID.
- StavrosK 9y ago
  Exactly, and OpenID connect adds an authentication layer over OAuth2 for this exact purpose. If we manage to build that future, it will be very useful and quite exciting, at least to me. There won't be compromised passwords any longer, just the one password you can easily change.
  - lucaspiller 9y ago
    You are ten years too late. The original OpenID did exactly this, and quite a few sites (especially tech focussed sites) let you sign in with it. Except then along came Google and Facebook with their proprietary login systems, and everyone jumped ship to those as they offered access to profiles rather than just a domain and possibly email address.
    - dboreham 9y ago
      We first worked in this problem at Netscape just after the AOL acquisition in 1998. It turns out to be impossible because: show me the money. Something we figured out within a few weeks back then.
      - cat199 9y ago
        Which is precisely why DNS and SMTP have failed miserably.
        garfij 9y ago
        Please elaborate on how DNS has failed? It seems to me that everyone uses DNS all the time and is an essential component of the Internet as we know it, but you and I may have differing notions of failure.
        mike-cardwell 9y ago
        I assume he was being sarcastic
        jamespo 9y ago
        Anyone would think the internet has become more closed in recent years or something
    - StavrosK 9y ago
      > You are ten years too late. As in, what I want has been working for ten years? I'm obviously not late at all, since websites still won't let me delegate my auth.
      - chowells 9y ago
        The few that allowed OpenID 10 years ago did let you delegate your auth. OAuth and OpenID Connect killed that.
        StavrosK 9y ago
        I don't care that some technology exists. I want it to be widespread. OpenID had huge usability problems.
    - tinus_hn 9y ago
      Not just the data but also using Facebook or Google accounts means your users are much more likely to be real people instead of spam bots.
onli 9y ago
If you have questions for the portier side of things for that, send me a mail (in profile). A tutorial like that would be very cool.

icebraining 9y ago

Why does Gitlab have to trust anyone? It's the user that has to trust stravros.io not to tell Gitlab that other people are authorized. It's no different than a regular email/password (with password recovery): if I register with user@stravros.io, then that email server becomes empowered to give access to the Gitlab account to anyone it wants. But that's not Gitlab's problem. See also OpenID.

StavrosK 9y ago
Exactly, and OpenID connect adds an authentication layer over OAuth2 for this exact purpose. If we manage to build that future, it will be very useful and quite exciting, at least to me. There won't be compromised passwords any longer, just the one password you can easily change.
- lucaspiller 9y ago
  You are ten years too late. The original OpenID did exactly this, and quite a few sites (especially tech focussed sites) let you sign in with it. Except then along came Google and Facebook with their proprietary login systems, and everyone jumped ship to those as they offered access to profiles rather than just a domain and possibly email address.
  - dboreham 9y ago
    We first worked in this problem at Netscape just after the AOL acquisition in 1998. It turns out to be impossible because: show me the money. Something we figured out within a few weeks back then.
    - cat199 9y ago
      Which is precisely why DNS and SMTP have failed miserably.
      - garfij 9y ago
        Please elaborate on how DNS has failed? It seems to me that everyone uses DNS all the time and is an essential component of the Internet as we know it, but you and I may have differing notions of failure.
        mike-cardwell 9y ago
        I assume he was being sarcastic
      - jamespo 9y ago
        Anyone would think the internet has become more closed in recent years or something
  - StavrosK 9y ago
    > You are ten years too late. As in, what I want has been working for ten years? I'm obviously not late at all, since websites still won't let me delegate my auth.
    - chowells 9y ago
      The few that allowed OpenID 10 years ago did let you delegate your auth. OAuth and OpenID Connect killed that.
      - StavrosK 9y ago
        I don't care that some technology exists. I want it to be widespread. OpenID had huge usability problems.
  - tinus_hn 9y ago
    Not just the data but also using Facebook or Google accounts means your users are much more likely to be real people instead of spam bots.

onli 9y ago

If you have questions for the portier side of things for that, send me a mail (in profile). A tutorial like that would be very cool.