3 ms·

What I don't understand is why all of these complicated SSO technologies like OAuth, OpenID Connect, SAML, LDAP, etc are integrated at the application layer at

What I don't understand is why all of these complicated SSO technologies like OAuth, OpenID Connect, SAML, LDAP, etc are integrated at the application layer at all. All these web applications should be using something like "Trusted Header SSO" [1], thus completely offloading authentication to the upstream reverse proxy (which does or should exist anyway) and then the whole problem vanishes at the level of the application. It's like the MxN problem that Language Server Protocol addresses, but here "M" is applications and "N" is authentication protocols. The fact that I have to hand over my administrator password to the grubby memory of random shoddy applications as they pass it over LDAP to authenticate me in my corporate "holy grail" SSO-everything environment is insane to me. [1]: https://www.authelia.com/integration/trusted-header-sso/introduction/ https://www.authelia.com/integration/trusted-header-sso/intr...

darkr 4y ago
OAuth isn’t an authentication protocol, it’s authorisation protocol (which attempts to solve nebulous authorisation delegation scenarios in an often overly generic and overly complicated way).
mdaniel 4y ago
For your consideration, centralizing auth like that imposes the requirement of (a) running a second piece of security tech (b) ensuring that all upstream applications are in the same authn/authz domain as the front proxy That's not even getting into the fact that the "SSO technologies" that you listed have vastly different mental models of what inputs and "claims" they support. Maybe you're hinting at https://xkcd.com/927/ https://xkcd.com/927/ but for better or worse I don't believe there is a magic wand authn/authz standard like you want
paulddraper 4y ago
I don't understand. For example: a CI service wants to write to a Slack channel. The CI service produces a request and directs me, the channel owner, to Slack where I confirm the request, and then the CI service obtains the scoped access token. How is this replaced by anything to do with an "upstream reverse proxy"? EDIT: I think you are thinking of OAuth as SSO. It can be used for that, but that's not it's "true" purpose like it is for SAML. --- > The fact that I have to hand over my administrator password as they pass it over LDAP to authenticate me Yes, that is insane and why LDAP is generally no longer used for web applications.
yrro 4y ago
If you only want to put a dumb web app behind a proxy then use oauth-proxy. But OAuth caters for a lot more than that use case.

darkr 4y ago

OAuth isn’t an authentication protocol, it’s authorisation protocol (which attempts to solve nebulous authorisation delegation scenarios in an often overly generic and overly complicated way).

mdaniel 4y ago

For your consideration, centralizing auth like that imposes the requirement of (a) running a second piece of security tech (b) ensuring that all upstream applications are in the same authn/authz domain as the front proxy That's not even getting into the fact that the "SSO technologies" that you listed have vastly different mental models of what inputs and "claims" they support. Maybe you're hinting at https://xkcd.com/927/ https://xkcd.com/927/ but for better or worse I don't believe there is a magic wand authn/authz standard like you want

paulddraper 4y ago

I don't understand. For example: a CI service wants to write to a Slack channel. The CI service produces a request and directs me, the channel owner, to Slack where I confirm the request, and then the CI service obtains the scoped access token. How is this replaced by anything to do with an "upstream reverse proxy"? EDIT: I think you are thinking of OAuth as SSO. It can be used for that, but that's not it's "true" purpose like it is for SAML. --- > The fact that I have to hand over my administrator password as they pass it over LDAP to authenticate me Yes, that is insane and why LDAP is generally no longer used for web applications.

yrro 4y ago

If you only want to put a dumb web app behind a proxy then use oauth-proxy. But OAuth caters for a lot more than that use case.