News for hackers. Stuff that matters.
Re:OpenID Connect specifications published as ISO standards by kodama-lens on Sunday November 10, 2024 @05:58PM (#42103177)
It would fix a lot of the provider specific aspects of OAuth2, if the spec would be more strict on some claim (attribute) names on the jwt ID token. Some provide groups, some don't. Some call it roles or direct_groups. Some include prefered_username, some don't. Some include full name, some don't and don't get me started on name and first_name.

If you implement OIDC you must certainly provide a configurable mapping system for source claim name to your internel representation of a user object.

Re:OpenID Connect specifications published as ISO standards by 8n4vidtmkvmk on Monday November 11, 2024 @01:49AM (#42104990)
That sounds bad. Why would they under specify all that??
Re:OpenID Connect specifications published as ISO standards by portaouflop on Monday November 11, 2024 @03:22AM (#42105387)
It’s hard / impossible to write a perfect spec maybe?

Or OAuth2 had a specific use case but has since been wrestled to do anything auth related