Because authentication and authorization is a hard problem in general. Hard to make it right, hard to make it secure, hard to make it simple. And exponentially

Because authentication and authorization is a hard problem in general. Hard to make it right, hard to make it secure, hard to make it simple. And exponentially harder to make it versatile. And if oauth is "hard", wait until you see OpenID and the myriad of extensions...