undefined | Better HN

0 pointsznpy3y ago0 comments

> In my experience with OAuth, one of the principle issues is that it's less a protocol and more a skeleton of a protocol.

Because it is, really.

OAuth (2.0) is really the backbone for OpenID.

0 comments

4 comments · 1 top-level

TallGuyShort3y ago· 3 in thread

OpenID Connect, specifically, where a lot of people mix those up and start looking at using OAuth for authentication. And if I'm not mistaken, logging out is implementation-dependent in OpenID Connect. There's some pseudo-standards but implementations vary in my experience. And OpenID Connect also has multiple flows for different kinds of applications. There's still a lot of confusion and complexity here.

neurostimulant3y ago

I'm still salty about how keycloak changed their openid logout behavior, removed the old behavior in the new version when there are still a lot of oidc clients out there that still expect the old behavior. I have two inatances of keycloak using the same version and somehow both have different iodc logout behaviors. I think it's due to one instance was upgraded from older version and inherited the old behavior, but I can't get the other instance to use the old behavior (the flag mentioned in the docs didn't work) unless I downgrade the version first.

grepfru_it3y ago

Can you elaborate on this a bit? My logout process through keycloak is through a hidden (back channel) url. As long as I hit that client url it will end the session. Applications, I find, have different behaviors. Gitea logs out the session, portainer just clears browser cookies but the session remains active

I’m using the same keycloak setup for almost 2 years now, with upgrades

1 more reply

sytringy053y ago

Yes, single log out is an ongoing nightmare. <Stares at Ping> As many here have said the size and range of use cases that OAuth and OIDC support is off its head. And that's with the big boys who have millions of users, throw in ${EveryCorp} that implements its own token server and bespoke implementation of the auth, well.. good luck to the AI trying to take over our jobs.

j / k navigate · click thread line to collapse