7 ms·
OAuth for the Open Web
- mattl 8y agoAaron is one of the cofounders (with Tantek Çelik) of the IndieWeb community.
- icebraining 8y agoI don't understand why the need for this new protocol; what's missing from OpenID?
- daveid 8y agoOpenID doesn't provide API access like OAuth does, does it?
- floatboth 8y agoExactly, it doesn't. Instead, OpenID had tons of weird bloat no one ever needed. XRI, XRDS, Yadis, WTF
- raarts 8y agoFrom Wikipedia : "the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[82] It allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain the basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format. OpenID Connect allows a range of organizations, including web-based, mobile and JavaScript clients, to request and receive information about authenticated sessions and end-users". My favorite implementation: Keycloak.
- jakubriedl 8y agoWhat do you mean by API access? OpenID Connect adds more features & standardization to OAuth2. So it supports everything that OAuth2 does. It all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" button.
- floatboth 8y agoWhen people talk about just "OpenID", they usually mean the original one, not Connect. The old OpenID did not have the ability to authenticate requests to the domain you signed in with. OpenID Connect adds lots of bloat, it's very large and complicated. IndieAuth is actually easy to understand and implement.
- dwaite 8y agoDepends on your point of view. IndieAuth has a bunch of modifications to OAuth2 behaviors that may not be compatible with existing deployments, and requires software to implement things like full HTML parsing libraries to read out link tags. There were many incomplete OpenID 1/2 implementations, and compatibility greatly suffered as a result. As someone who maintained an OpenID 1/2 OP for a few years, I would much rather implement OpenID Connect Basic Profile than IndieAuth. IndieAuth, like OpenID 1/2, also assumes the user has a known profile page or even knows what a URL is, which are both statistically unlikely.
- scrollaway 8y agoPeople replying to you are missing the point. What's missing from OpenID is adoption.
- lstamour 8y agoGreat, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.
- EGreg 8y agoThe problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything. Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.
- maxerickson 8y agoBrowsers could implement that part of the UI. Like address autofill.
- EGreg 8y agoAnd until then what do we do?
- maxerickson 8y agoCry in our beverages of choice.
- lstamour 8y agoThe existing AccountChooser interface, which was Google’s preferred SSO strategy until their recent experiments with zero-click SSO, was hosted at AccountChooser.com by the OpenID folks.
- mblaney 8y agoI made a bookmarklet that will store a url for you, and sign you in. You can create your own at: https://unicyclic.com/usb https://unicyclic.com/usb
- justinsaccount 8y agoPersona (https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona) had it right :(
- fiatjaf 8y agoSee https://portier.github.io https://portier.github.io
- EGreg 8y agoHere are some thoughts for distributed auth: https://github.com/Qbix/auth https://github.com/Qbix/auth
- fiatjaf 8y agoToo much about what it does, zero about _how_.
- fiatjaf 8y agoI know that maintaining a OAUth provider is a pain in the ass, not at all doable by anyone.
- maxerickson 8y agoDo you mean to say it is impossible or do you mean something like the more idiomatic "by just anyone"?
- colemickens 8y agoWhy not OpenID Connect? Not only does it have discovery for OAuth2 endpoints, it also specifies how to discovery the OIDC endpoint from a bare domain and username via WebFinger. It also has extensions for dynamic client registration, supports flows that work with input-restricted clients, as well as single page apps, and the UserInfo endpoint. And it's also already implemented and supported in lots of places. There are tools like Dex that offer OIDC and can use "upstream" OIDC providers for the actual user management. I'm not getting why IndieAuth is needed beyond what OIDC offers? Also, for those mentioning Persona/BrowserID/Portier, it is an OpenID Connect provider, and I've just recently sent PRs for it and Dex that allow them to work together.
- dane-pgp 8y ago> Why not OpenID Connect? Someone asked that in the comments of the article and the author responded with this link: https://indieweb.org/indieauth-vs-openid-connect https://indieweb.org/indieauth-vs-openid-connect The answer seems to boil down to IndieAuth being more decentralized.
- colemickens 8y agoAha, one more bit of indirection ala OpenID v1 to make the base identity portable. I like it. Thanks for the link!
- user5994461 8y agoNot at all. The answer is that the guy is pushing for his own product and company.
- amaccuish 8y agoI'd have preferred improvements to OAuth, see: https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529 https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45... and https://vimeo.com/52882780 https://vimeo.com/52882780
- amaccuish 8y agoIf URLs are to be used for user IDs, it'd make sense to require TLS, so we can remove the scheme from the IDs, so it's more memorable. Also the mockups are really confusing, you're logging in with a URL, not a "domain". Also, having the example text as "you.domain.com" would confuse users who have "github.com/user", as used in the previous examples.
- jakubriedl 8y agoThis seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" button.
- hardwaresofton 8y agoThe battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
- woranl 8y agoIt’s unfortunate. Big companies are pushing for OAuth 2.0 and trying to blindsided people as if it is an upgrade to OAuth 1.0a. It is not. OAuth 1.0a provides authenticity, integrity, and non-repudiation. Something that OAuth 2.0 does not provide.
- Boulth 8y agoGoogle and Microsoft are two big companies supporting OIDC.
- detaro 8y agoBut not the extensions the GP cites as meaning OIDC solves the same problem. And even if they did, I don't think it allows to isolate your identity from the identity provider you currently use, which seems to be a key aspect of IndieAuth: You can delegate the role of Identity Provider to a third party, but can change that third party, similar to how you could in "original" OpenID.
- woranl 8y agoOAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation attacks. MasterCard uses OAuth 1.0a instead of 2.0 https://developer.mastercard.com/blog/why-mastercard-doesnt-use-oauth-20 https://developer.mastercard.com/blog/why-mastercard-doesnt-...
- nradov 8y agoGiven that OAuth 2.0 uses TLS, could you please explain how such an attack could actually be executed?
- function_seven 8y agoA MITM TLS-busting proxy. Like on many corporate networks and in many country firewalls. Might seem like a remote chance from a user's point of view, but could be a threat from a payment processor's view, with billions of daily transactions. Also, easier to prove the integrity of the message when you're handling the authentication piece yourself rather than assuming TLS was correctly enforced end-to-end.
- user5994461 8y agoThe authentication part is called OpenID Connect and that's a subset of the OAuth 2.0 spec. Thus OAuth 2.0 supports both authorization and authentication. However providers are free to pick what features they want to provide to clients.
- jtl999 8y agoI was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Even storing my custom hashes in LDAP would have been acceptable.
- hb3b 8y agoShibboleth, simplesamlphp. Both offer easy ways to add custom login handlers.
- xenophonf 8y agoShibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
- jtl999 8y agoI'll give just Shibboleth a try later. I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
- Freak_NL 8y ago> but I'm no expert cryptographer either. You don't have to be, as you would not implement any cryptographic algorithms (ciphers, hash methods) yourself. Solid experience with software security in general is a requirement of course.
- user5994461 8y agoNot to be dismissive but better look for an alternative solution. The SAML spec is a beast, you can work on it for months, you will hardly get a few percents of it working. If you're doing that for a small company, maybe try to get a Microsoft active directory instead. It's a lot easier to setup and maintain and everything does their best to integrate with it.