Hacker News Reader

Comment by AlexandrB | Hacker News Reader

It's interesting how modern tech companies took Microsoft's "Embrace, Extend, Extinguish" playbook and ran with it. OAuth was supposed to be a standard that allowed interoperability but instead each company enforces the use of their own OAuth SDK/variant (see also Login With Apple).

View on HN

What about https://www.keycloak.org/? Is it any good for such solution to half-own OAuth provider?

If you are an enterprise and need to set up some way to do OpenID Connect/Oauth2/SAML 2... yes.

But I would not use it in a consumer facing product.

Can you clarify why not and what would you recommend? I am java developer who is developing side project which is using keycloak for user management. I find it awesome I can plug invarious oath providers (fb, google etc...) While still using my own registration workflow. Quite easy to plug it in my project as well

Ah, if you are using Java it is probably easier to use/develop for. One of the issue I've found is that the REST API is not well documented at all, and using it from an app perspective is not intuitive at all when you are trying to use it from applications that are not Java based.

oh alright... I thought there was more to it.

Debatable. You could implement the login with Google/Facebook/... APIs and not use their official clients, but many companies don't bother.

It's apparently forbidden to implement the API directly without using the SDK when developing a native app.

https://github.com/facebook/facebook-ios-sdk/issues/1385#iss...

Reply on news.ycombinator.com