4 ms·

I do appreciate the effort, and sorry for being a dick with my earlier comment (bad mood). I do feel though that this lacked concrete examples, and maybe shoul

by brap 5y ago

I do appreciate the effort, and sorry for being a dick with my earlier comment (bad mood). I do feel though that this lacked concrete examples, and maybe should have taken a step or two back to explain the more basic concepts. For example, who owns the authentication service, is it me (the todos developer) or a 3p? What exactly is the difference between all of these different tokens? What’s the actual protocol for issuing and using them? Etc. I think something like a “Todos API with OAuth2 from scratch with code snippets” could have been super helpful for noobs like myself.

Traubenfuchs 5y ago
Your sentiments and questions are all perfectly valid. I believe the majority of developers implementing oauth2 on their servers or integrating another service they need oauth2 for have not fully understood what they are doing. I know that's the case for me and I successfully implemented solutions for OIDC, saml, three-legged oauth2 and two-legged oauth2 on both the server and client. It's all an overengineered mess. A "complete guide" to this is still sorely lacking -maybe because it just is that complicated and can not be dumbed down?
- mooreds 5y ago
  I think this is pretty good (I wrote parts of it) but it still lacks everything (mobile use cases, custom scopes, token lifetime): https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth/ https://fusionauth.io/learn/expert-advice/oauth/modern-guide... I found these resources helpful: * Solving Identity Management in Modern Applications" walks through the identity life cycle in detail, from initial provisioning to deprovisioning. Concepts, standards, not a lot of code. Lots of focus on the workforce use cases (rather than customer). But still great: https://link.springer.com/book/10.1007/978-1-4842-5095-2 https://link.springer.com/book/10.1007/978-1-4842-5095-2 * "OAuth2 in Action", in contrast, builds an OAuth and OIDC server in JS, from scratch, so has lots and lots of code. Great section on tokens, and covers stuff beyond the standard OAuth grants, such as dynamic client registration. https://www.manning.com/books/oauth-2-in-action https://www.manning.com/books/oauth-2-in-action * Podcast episode about OAuth with the author of "OAuth2 in Action" https://www.se-radio.net/2019/08/episode-376-justin-richer-on-api-security-with-oauth-2/ https://www.se-radio.net/2019/08/episode-376-justin-richer-o...
mooreds 5y ago
> I do appreciate the effort, and sorry for being a dick with my earlier comment (bad mood). No worries! > I think something like a “Todos API with OAuth2 from scratch with code snippets” Here you are: https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth https://fusionauth.io/learn/expert-advice/oauth/modern-guide... and here's the github repo for the code in it: https://github.com/FusionAuth/fusionauth-example-modern-guide-to-oauth/ https://github.com/FusionAuth/fusionauth-example-modern-guid... That assumes you aren't implementing the Authorization Server (it uses FusionAuth, but should work with other OAuth servers like Identity Server or Keycloak). If you want that experience, then I'd recommend buying this book: "OAuth2 in Action" https://www.manning.com/books/oauth-2-in-action https://www.manning.com/books/oauth-2-in-action which takes you through all of the nitty gritty. Seriously, you'll implement the whole thing. It's pretty cool.

by brap 5y ago

Traubenfuchs 5y ago

Your sentiments and questions are all perfectly valid. I believe the majority of developers implementing oauth2 on their servers or integrating another service they need oauth2 for have not fully understood what they are doing. I know that's the case for me and I successfully implemented solutions for OIDC, saml, three-legged oauth2 and two-legged oauth2 on both the server and client. It's all an overengineered mess. A "complete guide" to this is still sorely lacking -maybe because it just is that complicated and can not be dumbed down?

mooreds 5y ago
I think this is pretty good (I wrote parts of it) but it still lacks everything (mobile use cases, custom scopes, token lifetime): https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth/ https://fusionauth.io/learn/expert-advice/oauth/modern-guide... I found these resources helpful: * Solving Identity Management in Modern Applications" walks through the identity life cycle in detail, from initial provisioning to deprovisioning. Concepts, standards, not a lot of code. Lots of focus on the workforce use cases (rather than customer). But still great: https://link.springer.com/book/10.1007/978-1-4842-5095-2 https://link.springer.com/book/10.1007/978-1-4842-5095-2 * "OAuth2 in Action", in contrast, builds an OAuth and OIDC server in JS, from scratch, so has lots and lots of code. Great section on tokens, and covers stuff beyond the standard OAuth grants, such as dynamic client registration. https://www.manning.com/books/oauth-2-in-action https://www.manning.com/books/oauth-2-in-action * Podcast episode about OAuth with the author of "OAuth2 in Action" https://www.se-radio.net/2019/08/episode-376-justin-richer-on-api-security-with-oauth-2/ https://www.se-radio.net/2019/08/episode-376-justin-richer-o...

mooreds 5y ago

> I do appreciate the effort, and sorry for being a dick with my earlier comment (bad mood). No worries! > I think something like a “Todos API with OAuth2 from scratch with code snippets” Here you are: https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth https://fusionauth.io/learn/expert-advice/oauth/modern-guide... and here's the github repo for the code in it: https://github.com/FusionAuth/fusionauth-example-modern-guide-to-oauth/ https://github.com/FusionAuth/fusionauth-example-modern-guid... That assumes you aren't implementing the Authorization Server (it uses FusionAuth, but should work with other OAuth servers like Identity Server or Keycloak). If you want that experience, then I'd recommend buying this book: "OAuth2 in Action" https://www.manning.com/books/oauth-2-in-action https://www.manning.com/books/oauth-2-in-action which takes you through all of the nitty gritty. Seriously, you'll implement the whole thing. It's pretty cool.