3 ms·

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId Connect spec as well, which was enlightening. I’d love to hear of other good resources - I am happy to pay for good stuff as long as it’s mot selling me service. Thank you!

baconfly 4y ago
That is so great to hear! We are in the midst of refactoring the documentation structure for different audiences: people who want to try it out quickly, those who want in depth understanding (like you), code contributors, non-dev It’s a long journey! If you ever see some of our docs again and feel that it has lost it’s way please reach out; It’s very important to us to not only show how the product works but also why :)
Perseids 4y ago
As I've opined here [1] I think OIDC is not a good example for an authentication protocol. As you are already into spec reading, you could take a look how SSH and TLS 1.3 (especially mutually authenticated TLS) handle the same topic. (All available freely as IETF RFCs.) And if you're interested in the cryptography, your can't go wrong with Cryptography Engineering (ISBN: 978-0470474242) by Ferguson, Schneier and Kohno. [1] https://news.ycombinator.com/item?id=31259826 https://news.ycombinator.com/item?id=31259826
yacine_ 4y ago
Open source documentation & tools are Okta/Auth0's biggest competitors :)
- rad_gruchalski 4y ago
  I find the documentation from Okta snd Auth0 pretty solid for understanding basic concepts of OpenID and Oauth.
legorobot 4y ago
Same experience for me too. I learned a lot, and integrating OAuth into a platform was pretty painless, including importing and managing users. It was the first time I felt like I can wrangle the OAuth spec and implementation, and really understand all the ways in which things can go wrong without proper care and expertise into how an OAuth server can be attacked, and how to mitigate those issues the right way.
andrewstuart2 4y ago
I'm also a huge fan of Keycloak for the same reason. It's been a while since I've looked at the Ory suite, but at least a year or two ago Keycloak was still the much more mature (and still fully OSS) product. Either way, reading the Oauth2 and OIDC specs are probably the best way to get a really solid understanding of modern standardized authn and how to start thinking about authz. https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata https://openid.net/specs/openid-connect-discovery-1_0.html#P... https://openid.net/specs/openid-connect-discovery-1_0.html#RFC6749 https://openid.net/specs/openid-connect-discovery-1_0.html#R...
- password4321 4y ago
  Keycloak: Open-Source Identity and Access Management https://news.ycombinator.com/item?id=31258469 https://news.ycombinator.com/item?id=31258469 and a couple lighter-weight projects to bookmark for myself: Caddy Security https://news.ycombinator.com/item?id=31258469#31259369 https://news.ycombinator.com/item?id=31258469#31259369 GoTrue https://news.ycombinator.com/item?id=29392517#29399741 https://news.ycombinator.com/item?id=29392517#29399741 and a brief discussion of SCIM (Cross-domain Identity), including a Keycloak v16 extension: https://news.ycombinator.com/item?id=31408059#31413662 https://news.ycombinator.com/item?id=31408059#31413662
daigoba66 4y ago
In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/ https://duendesoftware.com/. The folks behind the company and libraries know what they're doing.
- jorams 4y ago
  It's tiring to see this discussion topic pop up again and again and again, but: the Duende software is decidedly not open source. You can read the code, but that's it. They don't seem to be making such claims themselves either.
- mdaniel 4y ago
  https://github.com/DuendeSoftware/IdentityServer/blob/main/LICENSE https://github.com/DuendeSoftware/IdentityServer/blob/main/L... does not seem to square with any definition of "open source" I'm familiar with, and that goes double for having an in-repo file that just says "read this unversioned pdf on some other site"
- homarp 4y ago
  >(still is open source) I think https://en.wikipedia.org/wiki/Source-available_software https://en.wikipedia.org/wiki/Source-available_software is more accurate see https://duendesoftware.com/license/identityserver.pdf https://duendesoftware.com/license/identityserver.pdf (as pointed by https://github.com/DuendeSoftware/IdentityServer/blob/main/LICENSE https://github.com/DuendeSoftware/IdentityServer/blob/main/L... ) for their actual license.

baconfly 4y ago

That is so great to hear! We are in the midst of refactoring the documentation structure for different audiences: people who want to try it out quickly, those who want in depth understanding (like you), code contributors, non-dev It’s a long journey! If you ever see some of our docs again and feel that it has lost it’s way please reach out; It’s very important to us to not only show how the product works but also why :)

Perseids 4y ago

As I've opined here [1] I think OIDC is not a good example for an authentication protocol. As you are already into spec reading, you could take a look how SSH and TLS 1.3 (especially mutually authenticated TLS) handle the same topic. (All available freely as IETF RFCs.) And if you're interested in the cryptography, your can't go wrong with Cryptography Engineering (ISBN: 978-0470474242) by Ferguson, Schneier and Kohno. [1] https://news.ycombinator.com/item?id=31259826 https://news.ycombinator.com/item?id=31259826

yacine_ 4y ago

Open source documentation & tools are Okta/Auth0's biggest competitors :)

rad_gruchalski 4y ago
I find the documentation from Okta snd Auth0 pretty solid for understanding basic concepts of OpenID and Oauth.

legorobot 4y ago

Same experience for me too. I learned a lot, and integrating OAuth into a platform was pretty painless, including importing and managing users. It was the first time I felt like I can wrangle the OAuth spec and implementation, and really understand all the ways in which things can go wrong without proper care and expertise into how an OAuth server can be attacked, and how to mitigate those issues the right way.

andrewstuart2 4y ago

I'm also a huge fan of Keycloak for the same reason. It's been a while since I've looked at the Ory suite, but at least a year or two ago Keycloak was still the much more mature (and still fully OSS) product. Either way, reading the Oauth2 and OIDC specs are probably the best way to get a really solid understanding of modern standardized authn and how to start thinking about authz. https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata https://openid.net/specs/openid-connect-discovery-1_0.html#P... https://openid.net/specs/openid-connect-discovery-1_0.html#RFC6749 https://openid.net/specs/openid-connect-discovery-1_0.html#R...

password4321 4y ago
Keycloak: Open-Source Identity and Access Management https://news.ycombinator.com/item?id=31258469 https://news.ycombinator.com/item?id=31258469 and a couple lighter-weight projects to bookmark for myself: Caddy Security https://news.ycombinator.com/item?id=31258469#31259369 https://news.ycombinator.com/item?id=31258469#31259369 GoTrue https://news.ycombinator.com/item?id=29392517#29399741 https://news.ycombinator.com/item?id=29392517#29399741 and a brief discussion of SCIM (Cross-domain Identity), including a Keycloak v16 extension: https://news.ycombinator.com/item?id=31408059#31413662 https://news.ycombinator.com/item?id=31408059#31413662

daigoba66 4y ago

In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/ https://duendesoftware.com/. The folks behind the company and libraries know what they're doing.

jorams 4y ago
It's tiring to see this discussion topic pop up again and again and again, but: the Duende software is decidedly not open source. You can read the code, but that's it. They don't seem to be making such claims themselves either.
mdaniel 4y ago
https://github.com/DuendeSoftware/IdentityServer/blob/main/LICENSE https://github.com/DuendeSoftware/IdentityServer/blob/main/L... does not seem to square with any definition of "open source" I'm familiar with, and that goes double for having an in-repo file that just says "read this unversioned pdf on some other site"
homarp 4y ago
>(still is open source) I think https://en.wikipedia.org/wiki/Source-available_software https://en.wikipedia.org/wiki/Source-available_software is more accurate see https://duendesoftware.com/license/identityserver.pdf https://duendesoftware.com/license/identityserver.pdf (as pointed by https://github.com/DuendeSoftware/IdentityServer/blob/main/LICENSE https://github.com/DuendeSoftware/IdentityServer/blob/main/L... ) for their actual license.