3 ms·

What you've said seems to be able to be re-phrased as > Using OAuth 2.0 isn't hard. Once you have learned enough to literally re-write the library for it from

What you've said seems to be able to be re-phrased as > Using OAuth 2.0 isn't hard. Once you have learned enough to literally re-write the library for it from scratch, you should have no problem using it. Which, from my point of view, is another way of saying it's really hard to use. If I bought a car and the the owner's manual said > Once you are able to take the car apart to individual components and re-assemble it, you should understand it well enough to drive it I'd label it as hard to drive.

magicalhippo 2y ago
The point made, which I agree with, is that the API itself might be easy. What makes it hard is understanding the domain, the documentation, the tools and other bits around it. For the case of OAuth 2.0, I do really think it is an easy API to use as such. What makes OAuth 2.0 hard is exactly the other stuff mentioned above, which is compounded significantly if one uses OIDC on top of OAuth 2.0. Once you get an understanding for the domain and the technical language used, it ends up being just a few calls with some fairly straight forward data passed. As mentioned in another comment here, it can be as simple as just a single, simple POST call with a username and password to get a token, which you then pass in the usual HTTP header. How is that not easy?! This is very much unlike certain other APIs. I mentioned Vulkan in another comment as such an example, but there are many others. For example, using Vulkan you must actively take care to add fences and use semaphores to ensure ordered operations. That's on a whole other level of complexity compared to OAuth 2.0.
- RHSeeger 2y ago
  > What makes it hard is understanding the domain, the documentation, the tools and other bits around it. But the point is that, if you can't use the API without understanding the domain, then the API isn't easy to use. Saying that knowledge isn't _specifically_ the API (just required to use it) isn't reasonable. It would be one thing to say "this specific implementation of OAuth2 isn't hard to use" because, for a specific implementation, you'd only compare it against "the knowledge you need that's different from other implementations". But to use OAuth2 in general, you need all the "other" knowledge. Which translates to "OAuth2 is a hard/complicated API to use".
  - magicalhippo 2y ago
    I get your point, and overall I agree that for someone not well versed in authentication and authorization, OAuth 2.0 certainly can be hard to get figured out. It definitely took me some time to grok. However I still think it's a distinction that's worth making, because documentation, tooling etc is something one can do something about relatively easy.

magicalhippo 2y ago

The point made, which I agree with, is that the API itself might be easy. What makes it hard is understanding the domain, the documentation, the tools and other bits around it. For the case of OAuth 2.0, I do really think it is an easy API to use as such. What makes OAuth 2.0 hard is exactly the other stuff mentioned above, which is compounded significantly if one uses OIDC on top of OAuth 2.0. Once you get an understanding for the domain and the technical language used, it ends up being just a few calls with some fairly straight forward data passed. As mentioned in another comment here, it can be as simple as just a single, simple POST call with a username and password to get a token, which you then pass in the usual HTTP header. How is that not easy?! This is very much unlike certain other APIs. I mentioned Vulkan in another comment as such an example, but there are many others. For example, using Vulkan you must actively take care to add fences and use semaphores to ensure ordered operations. That's on a whole other level of complexity compared to OAuth 2.0.

RHSeeger 2y ago
> What makes it hard is understanding the domain, the documentation, the tools and other bits around it. But the point is that, if you can't use the API without understanding the domain, then the API isn't easy to use. Saying that knowledge isn't _specifically_ the API (just required to use it) isn't reasonable. It would be one thing to say "this specific implementation of OAuth2 isn't hard to use" because, for a specific implementation, you'd only compare it against "the knowledge you need that's different from other implementations". But to use OAuth2 in general, you need all the "other" knowledge. Which translates to "OAuth2 is a hard/complicated API to use".
- magicalhippo 2y ago
  I get your point, and overall I agree that for someone not well versed in authentication and authorization, OAuth 2.0 certainly can be hard to get figured out. It definitely took me some time to grok. However I still think it's a distinction that's worth making, because documentation, tooling etc is something one can do something about relatively easy.