OAuth 2.0 basically killed generic identity providers leaving us with a hand full of SSO providers you can use. It also instead of a simple generic OAuth 2.0 l

OAuth 2.0 basically killed generic identity providers leaving us with a hand full of SSO providers you can use. It also instead of a simple generic OAuth 2.0 library we had (and still have) separate libraries for the various OAuth SSO providers. Through this has converged a bit since the initial days. But the initial days where enough to cause harm to the ecosystem. It also needs a variety of "extensions" you have to add to make it secure. But which can slightly differ between SSO providers. (Note sure but I thing some of this "extensions" have been added to the spec retrospectively.) In conclusion I would say while OAuth 2.0 is widely used it also was widely harmful and lead to a further centralization and to users being more dependent on a few mega corporations. In this context it has fully failed some of the initial ideas people had about it when it's design started. Just because something is widely used doesn't mean it's not harmful or well designed. Adaptation of technology is often not driven by what is the technological best solution especially wrt. web technology.