Hacker News Reader

Comment by icebraining | Hacker News Reader

I don't understand why the need for this new protocol; what's missing from OpenID?

People replying to you are missing the point. What's missing from OpenID is adoption.

OpenID doesn't provide API access like OAuth does, does it?

From Wikipedia : "the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[82] It allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain the basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format. OpenID Connect allows a range of organizations, including web-based, mobile and JavaScript clients, to request and receive information about authenticated sessions and end-users".

My favorite implementation: Keycloak.

What do you mean by API access? OpenID Connect adds more features & standardization to OAuth2. So it supports everything that OAuth2 does.

It all mentioned

- user identity: core user info endpoint

- discovery: https://openid.net/specs/openid-connect-discovery-1_0.html

- client registration: https://openid.net/specs/openid-connect-registration-1_0.htm...

And also other features which are important for more complex cases than just simple "login using X" button.

When people talk about just "OpenID", they usually mean the original one, not Connect. The old OpenID did not have the ability to authenticate requests to the domain you signed in with.

OpenID Connect adds lots of bloat, it's very large and complicated. IndieAuth is actually easy to understand and implement.

Depends on your point of view. IndieAuth has a bunch of modifications to OAuth2 behaviors that may not be compatible with existing deployments, and requires software to implement things like full HTML parsing libraries to read out link tags. There were many incomplete OpenID 1/2 implementations, and compatibility greatly suffered as a result.

As someone who maintained an OpenID 1/2 OP for a few years, I would much rather implement OpenID Connect Basic Profile than IndieAuth.

IndieAuth, like OpenID 1/2, also assumes the user has a known profile page or even knows what a URL is, which are both statistically unlikely.

Exactly, it doesn't. Instead, OpenID had tons of weird bloat no one ever needed. XRI, XRDS, Yadis, WTF

Reply on news.ycombinator.com