hmmh. if OICD is an extension to OAuth 
i dunno. i don’t like how oauth requires specific federation to do a login. openid did not
@icedquinn I gave up on auth a long time ago.
I've heard ldap maybe makes it easier but I've decided that if I'm inviting someone onto something I self host then I probably trust them enough to just give them a shell account.
@swiley it looks like openid connect does try to bring back some of the cowboy logins. i peeked in the spec briefly and saw that it uses the ~/.well-known RFCs to help sites figure out how to talk to them, so OICD might allow us to bring back fedi-logins. 
if its a co-collaborator or a
user i don't mind putting them in LDAP.
what i don't want is what happened with solderpunk and i where i had to just flag them down on fedi because i couldn't post to their gitea and there was no real obvious avenue to open a ticket
i thought about setting up request tracker behind a mailbox so you just send an e-mail to do this on iceworks, and you can also just email me directly on iceworks, but this isn't really documented and it should be.
iceworks' UX is presently terrible and that's not ok.
if its a co-collaborator or a
user i don't mind putting them in LDAP. what i don't want is what happened with solderpunk and i where i had to just flag them down on fedi because i couldn't post to their gitea and there was no real obvious avenue to open a ticket
i thought about setting up request tracker behind a mailbox so you just send an e-mail to do this on iceworks, and you can also just email me directly on iceworks, but this isn't really documented and it should be.
iceworks' UX is presently terrible and that's not ok.
@swiley basically i don't want to contribute to the yet-another-bullshit-password problem, but i also don't want to farm it all out to big tech. for fedi stuff to ever work we do need to deal with logins *eventually*.
it amazes me that shibboleth has been out for like twenty years and we're still farting around with centralized IDs despite having the tech to exactly not do it for decades.
it amazes me that shibboleth has been out for like twenty years and we're still farting around with centralized IDs despite having the tech to exactly not do it for decades.
Follow
@icedquinn This seems like something that should be done with email.
Being able to use mastadon for authentication would be absolutely amazing though.
@swiley reading some of these things make me facedesk because reading things like "logging out doesn't expire sessions."
SAML already solved these problems.
I absolutely adore modern webshit that re-creates solved problems, does them wrong, but "at least its not XML"
SAML already solved these problems.
I absolutely adore modern webshit that re-creates solved problems, does them wrong, but "at least its not XML"
most of the identity services seem to be cloudshit or big java. i came across Ory which is in Go, so that's not bad ( https://www.ory.sh/ ), but i haven't tested it.
i'm also not yet 100% sure that OICD supports arbitrary logins like OpenID did, since the things i come across mention its an extension to OAuth which typically requires you to have pre-exchanged client keys (which means you'd only be able to do a pleroma/mastodon login if the site specifically likes your instance.)