6 ms·

Oh yes, throw out OIDC and let's go back to SAML. While I understand that complexity in standards might be bad because they allow you to shoot yourself in the

Oh yes, throw out OIDC and let's go back to SAML. While I understand that complexity in standards might be bad because they allow you to shoot yourself in the foot, I am definitely not going to stop using JWKs with JWT/JWS, those formats are actually quite simple and have allowed us to deploy authenticating proxies essentially everywhere instead of network based access control (which was always kind of broken), with slow key rotation included (thanks keycloak) Libraries should require the user to use pinned algos. Period.

CiPHPerCoder 7y ago
> Oh yes, throw out OIDC and let's go back to SAML. Aside from tptacek's observation: What prohibits the development of an OpenID Connect PASETO variant? (This is a rhetorical question.)
- sascha_sl 7y ago
  Adoption? Standardization? Not everything is a green field. Yes, I get to deal with SAML a lot, and with how quirky and incomplete and outright non-standard compliant some implementations, particularly for SaaS services are (and how there are always guides for Auth0, Otka and maybe ADFS, but never in plan SAML 2.0 terms), but we also use OIDC for a few more modern services, like Kubernetes and our own proxy and the amount of troubleshooting required has been essentially zero.
  - CiPHPerCoder 7y ago
    > Adoption? Standardization? Working on that. One of the goals of the PASETO project is to eliminate the use of JWT in modern standards, not to eliminate the standards that currently (but hopefully, temporarily) use JWT.
tptacek 7y ago
"Go back" to SAML? SAML is the industry standard for SSO.