<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Another potential direction is to stick with the plain old OAuth
protocol, which allows outsourcing authentication to one or more
services that you list up front. I talked to a local expert on
distributed authorization, and he said that what I've described
(plus a rarely used OpenID option) is the de facto standard on the
web today.<br>
<br>
For instance, with just OAuth, it's easy to bring up a service that
does all authentication via GitHub accounts.<br>
<br>
<div class="moz-cite-prefix">On 10/22/2015 11:02 AM, Adam Chlipala
wrote:<br>
</div>
<blockquote cite="mid:5628FA7F.3000400@csail.mit.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
On 10/21/2015 05:12 AM, Eran Meir wrote:<br>
<blockquote
cite="mid:CAEQ6Z0yvieLRcz1H5RvW2D2QOMp5s3Pf-PrvH1Rx41h-3_=uwQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>From what I read, the two main alternatives for
identity management are <a moz-do-not-send="true"
href="https://en.wikipedia.org/wiki/OpenID_Connect">OIDC
</a>(OpenID Connect) and <a moz-do-not-send="true"
href="https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language">SAML</a>.<br>
</div>
[...]<br>
</div>
<br>
</div>
<div>If I had to risk a guess I would say OIDC will
gradually replace SAML (or a new system will replace
both?), so I suggest supporting OIDC.<br>
</div>
<div><br>
OIDC is basically OAuth2.0 + <a moz-do-not-send="true"
href="https://en.wikipedia.org/wiki/JSON_Web_Token">JWT</a>.
A gradual implementation approach may be supporting those
building blocks as Ur/Web libraries first.<br>
</div>
</div>
</div>
</blockquote>
<br>
OK, this seems like the most positive recommendation so far, in
terms of a concrete "standard" that is in use by key players
today.<br>
<br>
Is anyone interested in taking the lead in developing a library?<br>
<br>
I'm motivated enough about at least the OAuth part, as I want to
use it for a web app, aimed at developers, to do login with GitHub
credentials. So, I expect that bit would get done by early 2016,
even if no one else volunteers. JWT/OIDC would be a lower
priority, but sounds appropriate for apps targeting broader
audiences.<br>
<br>
However, I would be very glad to see someone else taking the lead
on an open-source Ur/Web library that handles all the credible
enough authentication protocols. The existing OpenID library
could be a good inspiration:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://hg.impredicative.com/openid">http://hg.impredicative.com/openid</a><br>
[Presumably that original OpenID protocol is no longer worth
supporting.]<br>
<br>
Any takers?<br>
</blockquote>
</body>
</html>