Re:Nobody Cares About OAuth or OpenID Connect
by abelhabel on Wednesday January 23, 2019 @04:38PM
(#18983321)
Auth0 do the same thing though. They make library abstractions such as "passwordless" and make it a separate authentication flow altogether, where as in reality it is just a matter of generating temporary passwords. There is no need to not be able to just enable and disable temporary passwords for any user.
Also, try implementing generation of API-key like tokens for users that can be expired, revoked, authorized etc.
Auth0 have made products that hide complexity, in my opinion, but if those products fit your particular need, sure it works great.
I was very impressed by their rules concept [1] that allowed me to create quite non-trivial authentication scheme in one day from scratch [2] They also pay attention to development workflows by having great logs and debugging tool chain as a part of their service, very cool!
[1] https://auth0.com/docs/rules [2] https://gravitational.com/blog/aws-github-sso/