Hacker News Reader

Comment by skrtskrt | Hacker News Reader

I learned so much about AuthN and AuthZ from reading Ory code and docs.

Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc).

I read a few books as well but they were extremely poorly done.

I eventually also read the entire OpenId Connect spec as well, which was enlightening.

I’d love to hear of other good resources - I am happy to pay for good stuff as long as it’s mot selling me service.

Thank you!

View on HN

That is so great to hear! We are in the midst of refactoring the documentation structure for different audiences: people who want to try it out quickly, those who want in depth understanding (like you), code contributors, non-dev

It’s a long journey! If you ever see some of our docs again and feel that it has lost it’s way please reach out; It’s very important to us to not only show how the product works but also why :)

I'm also a huge fan of Keycloak for the same reason. It's been a while since I've looked at the Ory suite, but at least a year or two ago Keycloak was still the much more mature (and still fully OSS) product.

Either way, reading the Oauth2 and OIDC specs are probably the best way to get a really solid understanding of modern standardized authn and how to start thinking about authz.

https://openid.net/specs/openid-connect-discovery-1_0.html#P...

https://openid.net/specs/openid-connect-discovery-1_0.html#R...

Keycloak: Open-Source Identity and Access Management

https://news.ycombinator.com/item?id=31258469

and a couple lighter-weight projects to bookmark for myself:

Caddy Security https://news.ycombinator.com/item?id=31258469#31259369

GoTrue https://news.ycombinator.com/item?id=29392517#29399741

and a brief discussion of SCIM (Cross-domain Identity), including a Keycloak v16 extension:

https://news.ycombinator.com/item?id=31408059#31413662

As I've opined here [1] I think OIDC is not a good example for an authentication protocol. As you are already into spec reading, you could take a look how SSH and TLS 1.3 (especially mutually authenticated TLS) handle the same topic. (All available freely as IETF RFCs.) And if you're interested in the cryptography, your can't go wrong with Cryptography Engineering (ISBN: 978-0470474242) by Ferguson, Schneier and Kohno.

[1] https://news.ycombinator.com/item?id=31259826

Open source documentation & tools are Okta/Auth0's biggest competitors :)

I find the documentation from Okta snd Auth0 pretty solid for understanding basic concepts of OpenID and Oauth.

Same experience for me too. I learned a lot, and integrating OAuth into a platform was pretty painless, including importing and managing users.

It was the first time I felt like I can wrangle the OAuth spec and implementation, and really understand all the ways in which things can go wrong without proper care and expertise into how an OAuth server can be attacked, and how to mitigate those issues the right way.

In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/.

The folks behind the company and libraries know what they're doing.

It's tiring to see this discussion topic pop up again and again and again, but: the Duende software is decidedly not open source. You can read the code, but that's it. They don't seem to be making such claims themselves either.

https://github.com/DuendeSoftware/IdentityServer/blob/main/L... does not seem to square with any definition of "open source" I'm familiar with, and that goes double for having an in-repo file that just says "read this unversioned pdf on some other site"

>(still is open source)

I think https://en.wikipedia.org/wiki/Source-available_software is more accurate

see https://duendesoftware.com/license/identityserver.pdf (as pointed by https://github.com/DuendeSoftware/IdentityServer/blob/main/L... ) for their actual license.

Reply on news.ycombinator.com