3 ms·
Oh that’s interesting. This is purely anecdotal evidence with small n, but: 1) I concur that Oauth2 and OIDC are often conflated, and then contrasted to SAML a
by catlifeonmars 6y ago
Oh that’s interesting. This is purely anecdotal evidence with small n, but:
1) I concur that Oauth2 and OIDC are often conflated, and then contrasted to SAML and single-sign on (also conflated).
2) No one wants to manage identity (federation by default), but almost everyone wants to manage authorization. This makes sense, since authorization is strongly related to business logic.
- mooreds 6y ago> This makes sense, since authorization is strongly related to business logic. Definitely. I'd say you could further break authorization into two components: * what permissions/roles a user should have * what those permissions/roles can do in an application The former is somewhat amenable to being centralized in a user management application. The latter is always going to be application dependent and should be handled inside an application's business logic (perhaps abstracted to a central component there).