4 ms·
Your sentiments and questions are all perfectly valid. I believe the majority of developers implementing oauth2 on their servers or integrating another service
by Traubenfuchs 5y ago
Your sentiments and questions are all perfectly valid. I believe the majority of developers implementing oauth2 on their servers or integrating another service they need oauth2 for have not fully understood what they are doing. I know that's the case for me and I successfully implemented solutions for OIDC, saml, three-legged oauth2 and two-legged oauth2 on both the server and client. It's all an overengineered mess.
A "complete guide" to this is still sorely lacking -maybe because it just is that complicated and can not be dumbed down?
- mooreds 5y agoI think this is pretty good (I wrote parts of it) but it still lacks everything (mobile use cases, custom scopes, token lifetime): https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth/ https://fusionauth.io/learn/expert-advice/oauth/modern-guide... I found these resources helpful: * Solving Identity Management in Modern Applications" walks through the identity life cycle in detail, from initial provisioning to deprovisioning. Concepts, standards, not a lot of code. Lots of focus on the workforce use cases (rather than customer). But still great: https://link.springer.com/book/10.1007/978-1-4842-5095-2 https://link.springer.com/book/10.1007/978-1-4842-5095-2 * "OAuth2 in Action", in contrast, builds an OAuth and OIDC server in JS, from scratch, so has lots and lots of code. Great section on tokens, and covers stuff beyond the standard OAuth grants, such as dynamic client registration. https://www.manning.com/books/oauth-2-in-action https://www.manning.com/books/oauth-2-in-action * Podcast episode about OAuth with the author of "OAuth2 in Action" https://www.se-radio.net/2019/08/episode-376-justin-richer-on-api-security-with-oauth-2/ https://www.se-radio.net/2019/08/episode-376-justin-richer-o...