Show HN: Hydra – Open-Source OAuth2 Server

Re:Show HN: Hydra – Open-Source OAuth2 Server by atonse on Monday July 01, 2019 @02:18PM (#20328159)

If we have to implement all those things, is there really much of a remaining lift in implementing OIDC, apart from bringing in a library into a web app?

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by vwpolo3 on Monday July 01, 2019 @02:55PM (#20328530)

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2/OIDC is with 99% certainty not the right fit for you anyways.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by manigandham on Monday July 01, 2019 @04:39PM (#20329511)

Bringing in a library is different from building it from scratch. Pretty much every language has solid OIDC frameworks now.

OIDC is great for greenfield and much better than writing user signin flow every time.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by vwpolo3 on Tuesday July 02, 2019 @04:10AM (#20333163)

Username + Password with a cookie store is much better understood and harder to get wrong than implementing a full OIDC suite (server + client). If you're talking federated login, that's what OIDC is for. If you're talking "login", your opinion is misguided.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by manigandham on Tuesday July 02, 2019 @06:23PM (#20339931)

We might not be talking about the same thing. The thread was comparing to other OAuth servers, and then libraries, but nobody is talking about implementing it from scratch.

That being said, if you're working on a greenfield app where you need auth, using an OAuth/OIDC server is much better and faster than creating yet another membership system for that app. That's a major advantage of identity federation.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by wikibob on Monday July 01, 2019 @05:18PM (#20329867)

What is the suggested solution for Greenfield development?

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by kronin on Monday July 01, 2019 @07:59PM (#20330915)

Additionally, Greenfield dev where federated identity support is a requirement

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by dashwav on Tuesday July 02, 2019 @01:18PM (#20337227)

Lets say there are no restrictions, what type of authentication flow would you recommend looking into? I was under the impression that OAuth2 was pretty much the goto standard nowadays.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by manigandham on Tuesday July 02, 2019 @06:22PM (#20339919)

OpenID Connect with the authorization code flow using PKCE is the newest and best standard, and now works the same for both client-side and server-side apps.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by plange on Monday July 01, 2019 @05:53PM (#20330120)

This is NIH syndrome. You're way better off following the standards, and likely implementing standard libraries to actually make use of them.

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by vwpolo3 on Tuesday July 02, 2019 @04:09AM (#20333158)

Sorry, but following a standard for federation is not a substitute for building a log in system, which is what most people want when building "a web app".

[ Parent | on HN ]

Re:Show HN: Hydra – Open-Source OAuth2 Server by atonse on Monday July 01, 2019 @03:42PM (#20328980)

Ok makes sense, thanks (it was a genuine question, sounds like those protocols are quite complex.)

[ Parent | on HN ]