News for hackers. Stuff that matters.

A comment on Ory Keto, open source authorization server based on Google Zanzibar. Parent comment

Re:Ory Keto, open source authorization server based on Googl... by kyrra on Thursday April 08, 2021 @03:30PM (#26742739)
OAuth is just an identity tool (to say a login is a certain person). Zanzibar can be seen more as a ACL system that you can put across your system. So it is there to validate that a given user is able to access any specific resource.
[ Parent | on HN ]
Re:Ory Keto, open source authorization server based on Googl... by robertlagrant on Thursday April 08, 2021 @03:58PM (#26743043)
OAuth(2) are for access delegation. They are not for authentication or identity. For this reason, OIDC was built on top.
[ Parent | on HN ]