hmmh. if OICD is an extension to OAuth 
i dunno. i don’t like how oauth requires specific federation to do a login. openid did not
Follow
@icedquinn I gave up on auth a long time ago.
I've heard ldap maybe makes it easier but I've decided that if I'm inviting someone onto something I self host then I probably trust them enough to just give them a shell account.
@swiley basically i don't want to contribute to the yet-another-bullshit-password problem, but i also don't want to farm it all out to big tech. for fedi stuff to ever work we do need to deal with logins *eventually*.
it amazes me that shibboleth has been out for like twenty years and we're still farting around with centralized IDs despite having the tech to exactly not do it for decades.
it amazes me that shibboleth has been out for like twenty years and we're still farting around with centralized IDs despite having the tech to exactly not do it for decades.
@icedquinn This seems like something that should be done with email.
Being able to use mastadon for authentication would be absolutely amazing though.
@swiley there is some way to jangle OAuth authentication with pleroma. i don't know if we could bribe lain in to nudging it for OICD.
most of the identity services seem to be cloudshit or big java. i came across Ory which is in Go, so that's not bad ( https://www.ory.sh/ ), but i haven't tested it.
i'm also not yet 100% sure that OICD supports arbitrary logins like OpenID did, since the things i come across mention its an extension to OAuth which typically requires you to have pre-exchanged client keys (which means you'd only be able to do a pleroma/mastodon login if the site specifically likes your instance.)
most of the identity services seem to be cloudshit or big java. i came across Ory which is in Go, so that's not bad ( https://www.ory.sh/ ), but i haven't tested it.
i'm also not yet 100% sure that OICD supports arbitrary logins like OpenID did, since the things i come across mention its an extension to OAuth which typically requires you to have pre-exchanged client keys (which means you'd only be able to do a pleroma/mastodon login if the site specifically likes your instance.)
@swiley reading some of these things make me facedesk because reading things like "logging out doesn't expire sessions."
SAML already solved these problems.
I absolutely adore modern webshit that re-creates solved problems, does them wrong, but "at least its not XML"
SAML already solved these problems.
I absolutely adore modern webshit that re-creates solved problems, does them wrong, but "at least its not XML"
@swiley i'm also noticing unlike kanboard, a lot of applications want to cowboy their authentication. i guess this is neat in some ways, but it's like.
this is literally what SASL is for. it seriously is.
or just do header auth so i can slap an SSO proxy on it.
seriously. keycloak and friends already have every 2FA under the sun don't make me use half baked things
this is literally what SASL is for. it seriously is.
or just do header auth so i can slap an SSO proxy on it.
seriously. keycloak and friends already have every 2FA under the sun don't make me use half baked things
@icedquinn What would be easiest IMO would be users running mini CAs they could sign client keys with. So you trust the CA for that user identity.
@swiley in an amazing world we would just have the openid uris from ages past, and log in as meow@blob.cat
@icedquinn Oh dear, I think I'm getting auth-rabithole-ptsd. I'm going to go to bed.
if its a co-collaborator or a
what i don't want is what happened with solderpunk and i where i had to just flag them down on fedi because i couldn't post to their gitea and there was no real obvious avenue to open a ticket
i thought about setting up request tracker behind a mailbox so you just send an e-mail to do this on iceworks, and you can also just email me directly on iceworks, but this isn't really documented and it should be.
iceworks' UX is presently terrible and that's not ok.