[{"data":1,"prerenderedAt":337},["ShallowReactive",2],{"project-11798045":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":42,"post_text":44,"what":45,"said":70,"maker_in_thread":174,"shape":176,"grid":181,"attempts":292,"same_week":299,"maker_shows":39,"maker_hidden":329,"reader_version":330,"card":331},"11798045","Hydra","Run your own OAuth2\u002FOpenID Connect provider","title","Show HN: Run your own OAuth2\u002FOpenID Connect provider","https:\u002F\u002Fgithub.com\u002Fory-am\u002Fhydra#","github.com","aeneasr",1464553608,2016,161,49,201,2264,9,"notable","security_privacy","oauth2 authorization server","api",[24,25,26,27,28],"oauth2","openid connect","authentication","identity provider","self-hosted","curious",-0.156,{"positive":32,"neutral":33,"mixed":34,"critical":32},5,16,0,26,{"docs":37,"execution":38,"idea":40,"performance":41},{"positive":34,"critical":34},{"positive":39,"critical":39},1,{"positive":39,"critical":39},{"positive":34,"critical":39},[43,34,34,32,43,34,43,34,34,34,34,32,34,34,34,34,34,34,34,34,34,43,32,43,39,43,43,43,43,39,32,43,34,34,39,43,43,43,39,34],3,null,{"problem":46,"audience":44,"pricing":44,"motivation":44,"time_to_build":44,"stack":58,"openness":68,"stage":69,"team_size":69},{"value":47,"source":48,"evidence":49},"Running your own OAuth2 and OpenID Connect provider instead of relying on a hosted service","commenter",[50,54],{"id":51,"by":52,"text":53},"11798680","arekkas","Thanks, however Doorkeeper is an SDK, right? With Hydra, you simply boot the docker image and are done. If you're interested in OAuth2 frameworks, check out…",{"id":55,"by":56,"text":57},"11800319","welder","OAuth is super simple, you only need two endpoints for an OAuth provider. It only took a few hours to write the WakaTime OAuth provider implementation[1]. No offense and serious…",[59],{"value":60,"source":61,"evidence":62},"Go","inferred",[63,67],{"id":64,"by":65,"text":66},"11798419","akbar501","For anyone interested the Go client library is: https:\u002F\u002Fgithub.com\u002Fory-am\u002Ffosite",{"id":51,"by":52,"text":53},"open_source","unknown",{"praise":71,"objections":87,"requests":109,"questions":127,"alternatives":145},[72,76],{"value":73,"source":48,"evidence":74},"Easy to run: boot the Docker image and you are done",[75],{"id":51,"by":52,"text":53},{"value":77,"source":48,"evidence":78},"Well engineered and built on the security-focused fosite library",[79,83],{"id":80,"by":81,"text":82},"11798831","olalonde","Ok, thanks. So let's say I wanted to use Hydra for authenticating requests made to my REST API, I'd have to make an API call to Hydra on each request, right? Would be interesting…",{"id":84,"by":85,"text":86},"11800515","abritishguy","OAuth is a framework not a protocol. The security it provides can vary greatly between implementations. Fosite (which is what this is based on) is a very good implementation from…",[88,99],{"value":89,"source":48,"evidence":90},"Claims OpenID Connect but tokens are opaque, not JWT",[91,95],{"id":92,"by":93,"text":94},"11802270","dalu","You're doing OIDC but OIDC requires JWT. Well sorry but if you're not using JWT then this isn't OIDC. The whole point of OIDC is token verification, you provide an identity and…",{"id":96,"by":97,"text":98},"11799294","sakopov","I know it's in the title but I don't see any OpenID capabilities here. Looks like Oauth2 spec implementation. Am i missing something?",{"value":100,"source":48,"evidence":101},"Revoking JWTs before expiry is hard, a trade-off with per-request checks",[102,106],{"id":103,"by":104,"text":105},"11799814","jon-wood","One thing I've not quite got my head around with JWT is not authenticating tokens with the server on each request - am I really just meant to assume a token is trusted until it's…",{"id":107,"by":97,"text":108},"11803836","Technically JWTs cannot be revoked once they're issued (they just expire). You have to make sure that you delete the JWT from your preferred storage when you sign a user out and…",[110,114,121],{"value":111,"source":48,"evidence":112},"Integration examples with web frameworks like Express, Rails and Django",[113],{"id":80,"by":81,"text":82},{"value":115,"source":48,"evidence":116},"A serverless AWS Lambda version",[117],{"id":118,"by":119,"text":120},"11799484","smw","It'd be really neat to see an amazon lambda serverless version of this.",{"value":122,"source":48,"evidence":123},"Support for issuing JWTs",[124],{"id":125,"by":52,"text":126},"11799801","Depends, if you use JWT you can cryptographically verify that the token and the token claims are valid. Right now, Hydra does not issue JWTs but it would be easy as pie to add…",[128,138],{"value":129,"source":48,"evidence":130},"How to integrate with an existing API, and whether it proxies requests",[131,134],{"id":132,"by":81,"text":133},"11798717","How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there…",{"id":135,"by":136,"text":137},"11798880","simplify","Doesn't the nature of an OAuth server imply that it can be added to existing infrastructures? Or is there an issue you foresee with non-Hydra libraries?",{"value":139,"source":48,"evidence":140},"Whether it replaces hosted services like Auth0",[141],{"id":142,"by":143,"text":144},"11799347","ClayM","Would this or coreos\u002Fdex replace something like Auth0?",[146,152,159,163,167],{"value":147,"source":48,"evidence":148},"Doorkeeper",[149],{"id":150,"by":136,"text":151},"11798667","If you're interested in this sort of thing, Doorkeeper[1] is a robust, open source OAuth 2 provider that's been around for about 5 years. We use it as a standalone app, and have…",{"value":153,"source":48,"evidence":154},"Dex (coreos)",[155],{"id":156,"by":157,"text":158},"11799083","ethernetdan","Also similar: https:\u002F\u002Fgithub.com\u002Fcoreos\u002Fdex",{"value":160,"source":48,"evidence":161},"Auth0",[162],{"id":142,"by":143,"text":144},{"value":164,"source":48,"evidence":165},"Kong",[166],{"id":132,"by":81,"text":133},{"value":168,"source":48,"evidence":169},"Let's Auth",[170],{"id":171,"by":172,"text":173},"11799008","scrollaway","Check out Let's Auth: https:\u002F\u002Fgithub.com\u002Fletsauth\u002Fletsauth.github.io It's a successor to Mozilla Persona in development. Details in the readme and on freenode #letsauth (mirrored…",{"comments":34,"answered":34,"key":175},[],{"commenters":177,"max_depth":178,"maker_replies":34,"first_comment_mins":179,"lifespan_hours":180},23,7,91,27,[182,184,186,188,191,192,195,197,198,203,206,208,211,214,216,219,222,225,227,230,231,233,235,237,239,242,244,246,248,249,251,253,254,256,257,258,261,264,265,267,270,272,276,278,281,283,285,287,289],[150,34,43,183,136,34],"project\u002Fneutral\u002Fnone",[51,34,34,185,52,34],"commenter\u002Fneutral\u002Fnone",[187,34,34,185,136,34],"11798721",[189,34,32,190,52,34],"11798765","project\u002Fpositive\u002Fnone",[135,34,43,183,136,34],[193,34,43,194,52,34],"11799789","project\u002Fneutral\u002Fdocs",[196,34,34,185,136,34],"11803366",[156,39,43,183,157,34],[199,200,34,201,202,34],"11798870",2,"other\u002Fneutral\u002Fnone","defiancedigital",[204,200,34,201,205,34],"11799399","johns",[207,200,34,201,202,34],"11802193",[209,200,34,201,210,34],"11802482","neilellis",[212,43,34,201,213,34],"11798641","Pyxl101",[215,43,32,190,52,34],"11798655",[217,43,34,201,218,34],"11798738","bogomipz",[220,43,34,201,221,34],"11798790","xenophonf",[223,43,34,201,224,34],"11799138","callahad",[226,43,34,201,213,34],"11802819",[228,43,34,201,229,34],"11798824","andy_ppp",[171,43,34,201,172,34],[232,43,34,201,224,34],"11799131",[234,43,34,201,52,34],"11799890",[236,43,34,201,172,34],"11799938",[238,43,34,201,52,34],"11799956",[240,43,34,201,241,34],"11800766","StavrosK",[132,243,43,183,81,34],4,[245,243,43,183,52,34],"11798791",[80,243,32,247,81,34],"project\u002Fpositive\u002Fexecution",[125,243,43,183,52,34],[92,243,39,250,93,34],"project\u002Fcritical\u002Fexecution",[252,243,43,183,97,34],"11799300",[103,243,43,183,104,34],[255,243,43,183,52,34],"11799884",[107,243,43,183,97,34],[64,32,43,183,65,34],[55,259,39,260,56,34],6,"project\u002Fcritical\u002Fidea",[262,259,32,263,52,34],"11800498","project\u002Fpositive\u002Fidea",[84,259,32,190,85,34],[96,178,39,266,97,34],"project\u002Fcritical\u002Fnone",[268,178,34,185,269,34],"11800166","darkr",[271,178,34,185,52,34],"11800468",[273,274,39,275,241,34],"11800769",8,"project\u002Fcritical\u002Fperformance",[118,18,43,277,119,34],"project\u002Fneutral\u002Fidea",[279,18,43,280,52,34],"11799803","project\u002Fneutral\u002Fexecution",[142,282,43,183,143,34],10,[284,282,43,183,52,34],"11799810",[286,282,39,266,104,34],"11800307",[288,282,34,185,52,34],"11800471",[290,282,34,291,104,34],"11800803","other\u002Fneutral\u002Fpricing",[293,294],{"id":4,"t":12,"points":14,"comments":15},{"id":295,"t":296,"points":297,"comments":298},"12789720",1477415845,88,12,[300,305,310,315,320,324],{"id":301,"name":302,"points":303,"category":304},"11778077","Qbserve",429,"productivity",{"id":306,"name":307,"points":308,"category":309},"11777128","Dead Yet?",164,"web_saas",{"id":311,"name":312,"points":313,"category":314},"11781295","Chatbots made easy",131,"ai",{"id":316,"name":317,"points":318,"category":319},"11786984","Decompiler",98,"dev_tools",{"id":321,"name":322,"points":323,"category":20},"11808332","Arc",72,{"id":325,"name":326,"points":327,"category":328},"11781891","webblocks",66,"learning_science",false,"v2",{"id":332,"name":5,"line":6,"ai":329,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":333,"top":18,"kw":334,"maker":11,"domain":10,"tier":19,"attempts":200,"strip":335,"url":9,"mix":336,"praise":73,"objection":89,"sub":21},11798045,-0.16,[24,25,26,27,28],"3005303000050000000003531333315300133310",[32,33,34,32],1794036544710]