3 ms·
It works really well for scaling your systems. In the case of "third party" this can mean disparate services within your platform, permitting you to fully isola
by Jenk 5y ago
It works really well for scaling your systems. In the case of "third party" this can mean disparate services within your platform, permitting you to fully isolate the authentication from literally everything else.
- keephand 5y agoSorry but that’s just wrong. The biggest auth systems in the world (Google, Amazon, Microsoft) do not rely on OAuth2 for internal services. Isolating auth into a central service and acquiring user consent as a third party, which very literally is the only purpose of OAuth2, are two very different things. Saying that you need a third party delegation tool to „scale“ an auth system is like saying that you need a good combustion engine to build an electric car.
- dwaite 5y agoGoogle and Microsoft do use OpenID Connect for internal services, as well as their consumer-facing services. While they do not necessarily use consent for delegation, they do use automated policies to restrict API access to what the application needs. Likewise, having a common protocol for getting authentication and API access allows them to decompose systems. Having to build first party authentication and API access systems would naturally encourage applications to become monolithic.
- Jenk 5y agoYou are wrong. You do not need to acquire consent, either, when it is implicitly granted because the service is the same system as the IdP. I.e., consent is requested/granted when they sign up with your IdP.