3 ms·
Sorry but that’s just wrong. The biggest auth systems in the world (Google, Amazon, Microsoft) do not rely on OAuth2 for internal services. Isolating auth into
by keephand 5y ago
Sorry but that’s just wrong. The biggest auth systems in the world (Google, Amazon, Microsoft) do not rely on OAuth2 for internal services. Isolating auth into a central service and acquiring user consent as a third party, which very literally is the only purpose of OAuth2, are two very different things. Saying that you need a third party delegation tool to „scale“ an auth system is like saying that you need a good combustion engine to build an electric car.
- dwaite 5y agoGoogle and Microsoft do use OpenID Connect for internal services, as well as their consumer-facing services. While they do not necessarily use consent for delegation, they do use automated policies to restrict API access to what the application needs. Likewise, having a common protocol for getting authentication and API access allows them to decompose systems. Having to build first party authentication and API access systems would naturally encourage applications to become monolithic.
- Jenk 5y agoYou are wrong. You do not need to acquire consent, either, when it is implicitly granted because the service is the same system as the IdP. I.e., consent is requested/granted when they sign up with your IdP.