4 ms·
This advice is wrong on some many levels. Building your own OIDC/OAuth/SAML infrastructure is incredibly expensive, error prone and dangerous; and not mention y
by ExoticPearTree 3y ago
This advice is wrong on some many levels. Building your own OIDC/OAuth/SAML infrastructure is incredibly expensive, error prone and dangerous; and not mention you need people to code it, run it securely, audit it, test it.
Even running something like a self-hosted Keycloak instance/cluster is not easy either and comes with its own set of problems.
- nailer 3y agoOAurh/OIDC on its own is literally a library install away for most languages and would fit in about 200 lines of code
- ExoticPearTree 3y agoClient-wise maybe, but the whole IdP part is an entirely different and a whole lot more complicated. If it would have been that easy, everybody would build OAuth/OIDC providers left and right.
- moribvndvs 3y agoHave you actually rolled out such a solution yourself? Yes, the contractual obligations of the protocol are deceptively shallow, but that is the easiest part. We’re not just talking about assembling a JWT and asserting it. We’ve got to hook up all the plumbing for signing, key management, credential management, various auth flows (after all, not all apps are created equality), RBAC, SSO, federation, custom rules, and all the accoutrement in between. Yeah, great, you can hack in a solution for your simple app, and if your use case lets you get away with it then go with god. A fully compliant system, batteries included, is a staggering amount of work.