5 ms·
Isn't this just reinventing OAuth? OAuth already has grant_type and "scope" to cover different devices, flows and permissions.
by svnpenn 5y ago
Isn't this just reinventing OAuth?
OAuth already has grant_type and "scope" to cover different devices, flows and permissions.
- throwaway81523 5y agoUm no. The issue is authorization is a million tentacled octopus that reaches into every crevice of your app, and if the app is built out of multiple services, auth reaches into those. The thread someone just linked from yesterday (https://news.ycombinator.com/item?id=28543457 https://news.ycombinator.com/item?id=28543457) and the article it points to is sales-y but gives a picture of some of the issues.
- himinlomax 5y agoThe auth in OAuth stands for authentication. This is authorization.
- alex-olivier 5y agoAuthor of the article here. This is a very common question we get. OAuth is great for when the permissions can be modelled as a set of roles/scopes which apply uniformity. Where that breaks down as described in the article is when there needs to be more context involved in the authoriZation - beyond simple roles from your chosen autheNtication provider.
- svnpenn 5y agoThe fact that OAuth isnt mentioned a single time in the article is glaring. You should at least have a paragraph like "why not just use OAuth?" where you answer that question. Otherwise it seems youre avoiding the question on purpose, as these two items are clearly in the same space.
- alex-olivier 5y agoThanks for the feedback - are are working on adding more comparisons of technologies onto https://cerbos.dev https://cerbos.dev and will certainly make sure to include OAuth