Learn Authentication the Hard Way: Part Three
I am currently an IAM engineer and can I just throw out there how much I hate OAuth/OIDC, I work at a large org and have to integrate with dozens of different vendors and applications and not a single one has the same way of doing OAuth because to quote the spec, wait it isn't a spec it is a "framework" we have to remember that, under interoperability it says<p>>  OAuth 2.0 provides a rich authorization framework with well-defined security properties.  However, as a rich and highly extensible framework with many optional components, on its own, this specification is likely to produce a wide range of non-interoperable implementations.<p>Don't get me wrong, OAuth is still better than WS-Fed and what we had before but we really need to come up with a real standard and spec for authentication, because OAuth/OIDC is a joke. It isn't just me either that thinks this one of the authors of the OAuth spec said as much[1]<p>Can anyone tell me what their experience with OAuth has been, or have they been able to get it to work across multiple different systems. I would love to believe it is just my org, but it seems like the entire identity space is a clusterf<i></i>ck.<p>[1] <a href="https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529" rel="nofollow">https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45...</a>