I've been learning oauth at work and started implementing openid using keycloak. Now I'm in the process of setting in a private CA with vault from hascicorp.

I've been learning oauth at work and started implementing openid using keycloak. Now I'm in the process of setting in a private CA with vault from hascicorp. What ddevault is proposing is basically oauth implemented in terms of TLS and certificate autorities. It's not bad as an idea, per se. The problem is, as far as I see, that x509 and TLS pull into the discourse a lot of hard topics. You pull in x509 and you also pull in the whole ITU/X.500 thing. Have fun with that. Just these days I was thinking that I'm having a hard time finding certificate authorities explained in terms of actors and interactions, instead of cryptography. Oauth/oidc instead is just that: authorization delegation. It starts and ends with those RFC/specs. It helps a lot to know that all you need to know is contained in that finite number of documents.