#oauth2 — Public Fediverse posts

Canop'Tips 💡 Connectez #Canopsis à votre fournisseur d'identité !

#OAuth2 et #OpenIDConnect natifs dans Canopsis :

✅ Connectez Canopsis à votre fournisseur d'identité
✅ Centralisez les accès, supprimez les mots de passe superflus
✅ Pilotez les droits depuis votre annuaire d'entreprise

Compatible GitHub, GitLab, Google et plus encore.

🔗 https://doc.canopsis.net/latest/guide-administration/administration-avancee/methodes-authentification-avancees/#authentification-oauth2-openid

#SSO #ITOps #OpenSource #Capensis

Say you have a user U of an app A, and A needs to access U's data on a third party web api T on U's behalf, how do you do this without A asking U for his/her/their password for T? This is fundamentally the problem OAuth solves.

Software engineer Ashutosh Krishna breaks down the OAuth 2.0 workflow in this guide published today.

"How OAuth 2.0 Works: A Practical Guide for Backend Developers"

https://www.freecodecamp.org/news/oauth-2-0-guide-for-backend-developers

#security #backend #oauth2 #pkce #tokens #programming

via #AIFoundry : Building Agents that Act on Your Behalf with Toolboxes in Foundry

https://ift.tt/YyZaFwc
#FoundryToolboxes #ToolboxesInFoundry #AgentDelegation #EndUserDelegation #OAuth2 #OnBehalfOf #Entra #MCP #WorkIQ #ModelContextProtocol #M365 #AIAgents #AuthGuardrails #T…

I don't understand why there are so many variations on OAuth2 flow and each of them is kind of a PITA.

I had the "opportunity" to meet the Frankenstein of the variations, SMART-on-FHIR. The official Java library latest release is from 2018 but the standard is still live and adopted. But honestly, why reinvent again the RBAC wheel, just in a worse way?

#FHIR #OAuth2 #eHealth

Stop rotating OAuth2 client secrets manually. Use HashiCorp Vault dynamic secrets to generate short-lived client_id/secret pairs on demand with configurable TTL and auto-revocation via the authorization server's admin API. #oauth2 #vault #dynamic-secrets

https://www.valtersit.com/vault/secure-oauth2-client-secret-with-hashicorp-vault-dynamic-sec-55e675/

One Open-source Project Daily

Simple, unobtrusive authentication for Node.js.

https://github.com/jaredhanson/passport

#1ospd #opensource #express #nodejs #oauth #oauth2 #openid #openidconnect #passport #saml

#Keycloak question: is there a way to allow multiple service accounts/machines to use one OIDC client?

Normally we'd go one OIDC client in confidential mode with the service account using client credentials flow - per machine access.

However, each OIDC client/service account means a new OIDC audience - and AWS has a hard limit of 100.

Direct Access grant flow is deprecated already and removed entirely I think from Oauth2.1 spec in strict mode.

Maybe we could just create users to represent the machines - but we'd have to find a way to exempt them from Realm policies like MFA etc and it still feels icky.

CC @4censord #OIDC #Oauth #Oauth2

I had a great time Oauth Security Workshop 2026 in Leipzig. So many brilliant people.

#openid #oauth2 #wallet #credentials #osw2026

Current status back at home

75–80% of enterprise deals stall on authentication. SSO, SCIM, MFA — here's when you need what, and which platform to choose at each growth stage.

Full details here: https://ostechnix.com/why-startups-need-smarter-authentication-before-they-scale/

#Authenitcation #Security #Opensource #IAM #OAuth2

For a project I am working on I am currently researching the three Open ID Connect (OIDC) flows:

* Authorization Code Flow is clear
* Implicit Flow is to be avoided due to the potential for leakage of tokens

... and then there is the Hybrid Flow. I understand how it works, i.e. the sequence of steps and their parameters, but no matter where I looked, I could not find a single example for an actual **use case** of the Hybrid Flow. Lots of explanations about how it works, but no mention of the "why".

When would I want to use the Hybrid Flow over the Authorization Code Flow? Or is this an instance of "you'll know it when you'll see it"?

#oidc #oauth2 #DigitalIdentity

Логин через Telegram по-новому: разбираем OIDC-флоу oauth.telegram.org и собираем его на Python

Telegram теперь полноценный OpenID-провайдер: oauth.telegram.org, JWKS, JWT, claims. Туториалы на GitHub при этом массово показывают старый виджет с HMAC от bot-token и /setdomain в BotFather. Я разобрался с новым флоу и собрал PoC на Python — рассказываю, как устроен обмен между фронтом, Telegram и бэком, чем Login library через telegram-login.js отличается от manual OIDC code flow с PKCE, что настраивать в BotFather (спойлер: не в чате, а в его mini-app), как протестировать локально через ngrok, и какая проверка id_token нужна вместо ручного HMAC.

https://habr.com/ru/articles/1033632/

#telegram #telegram_login #openid_connect #oidc #oauth2 #jwt #jwks #pyjwt #python #authentication

One Open-source Project Daily

Simple, unobtrusive authentication for Node.js.

https://github.com/jaredhanson/passport

#1ospd #opensource #express #nodejs #oauth #oauth2 #openid #openidconnect #passport #saml

Per-user OAuth для MCP-серверов: Keycloak, n8n и Telegram-бот через один Auth Proxy

MCP-серверы не умеют в авторизацию, n8n не умеет в per-user токены, а OAuth-клиенты говорят на разных диалектах. Рассказываем, как один Auth Proxy перед FastMCP Gateway закрыл все три проблемы — и почему в итоге бот переехал на LangGraph Архитектура, грабли и код

https://habr.com/ru/articles/1030302/

#MCP #OAuth2 #Keycloak #FastMCP #LangGraph #n8n #Telegramбот #peruser_авторизация #AIагент #Auth_Proxy

@tatsh Woo! mutt-oauth2 just made my day!

Previously a gent from MIT IS&T put in HEROIC amounts of effort to pull together the prior jank-fest of oauth2 scripts and mutt configurations...

But with your nice new package I can 'uv tool install', add the bits you specified to my muttrc and BOOM! I'm reading my MIT E-mail in a sane interface that doesn't make my remaining damaged eye want to shrivel up and retire :)

Thank you!

(Also just sent a Buy Me a Coffee :)

#mutt #oauth2 #office365

#DPoP closes a real gap in #OAuth2, but there’s a catch….

Sender-constrained tokens are a meaningful upgrade over bearer tokens, but they don't fully solve the challenge of browser key storage.

Check out the #InfoQ article by Dhruv Agnihotri for a deep dive: https://bit.ly/4w62YGA

#WebDevelopment #Security #Cryptography #CyberSecurity

Is there any way to setup OAuth2 authentication on self-hosted ejabberd (where ejabberd acts as a client and delegates authentication to an external identity provider)? Prosody seems to have modules for that, but I feel like migrating might be a pain... #XMPP #OAuth2 #ejabberd #Prosody

🎉🎉Introducing IPv8: the #protocol no one asked for, complete with #OAuth2 JWT jargon and #DHCP8 magic! Because what the internet needed was another layer of #complexity and buzzwords to solve problems no one knew existed. 🙄🔧✨
https://www.ietf.org/archive/id/draft-thain-ipv8-00.html #IPv8 #InternetBuzzwords #HackerNews #ngated

Version 4.11.0 of #syslog_ng contains contributions from #Databricks related to #OAuth2 authentication. Recently, they published a blog about how this enables their customers to send logs to their data lake using syslog-ng and the #OpenTelemetry protocol.
https://www.syslog-ng.com/community/b/blog/posts/streaming-syslog-ng-data-to-your-lakehouse-using-opentelemetry

Most OAuth tutorials stop once login works.

But in a normal authorization code flow, client_id, scope, redirect_uri, state, and nonce can end up in the browser URL, logs, and history.

I wrote a hands-on tutorial showing how to use PAR with Quarkus OIDC and Keycloak to push that request over a back-channel instead.

https://www.the-main-thread.com/p/par-quarkus-oidc-keycloak-pushed-authorization-requests

#Java #Quarkus #OAuth2 #OIDC #Keycloak #Security #DevOps

JWT авторизация в FastAPI: от теории к практике

Представьте себе, что вы разработчик, и перед вами стоит задача: сделать так, чтобы после входа пользователь мог получать свои личные данные, не вводя пароль при каждом клике. Звучит как классическая задача аутентификации, правда? Традиционный подход — сессии. Вы логинитесь, сервер создаёт сессию, запоминает ваш ID у себя в базе данных, а вам выдаёт куку с ID этой сессии. Всё работает, пока вы на одном сервере. А если у вас их два? Или десять? Куда девать сессии? Начинаются проблемы с синхронизацией, Redis, общими хранилищами… Альтернатива — JWT (JSON Web Token). В этой статье мы с вами:

https://habr.com/ru/articles/1017246/

#FastAPI #JWT #авторизация #аутентификация #Python #токены #API #бэкенд #JSON_Web_Token #OAuth2

Damit die MCP Server nicht einfach frei im Internet stehen, hab ich sie mittels #authentik mit einem #oauth2 Flow gesichert.

commands for kanidm + bookstack

kanidm create group bookstack_admin

kanidm system oauth2 create-claim-map bookstack bookstack_roles bookstack_admin admin

kanidm system oauth2 update-scope-map bookstack bookstack_users email groups openid profile bookstack_roles

kanidm group add-members bookstack_admin stelb

Environment for bookstack:
OIDC_USER_TO_GROUPS=true
OIDC_GROUPS_CLAIM=bookstack_roles
OIDC_REMOVE_FROM_GROUPS=true

#iam #idm #oauth2 #roles #claim-map #kanidm

I did this for bookstack with kanidm
Given the oauth2 app is 'bookstack':
map claims (roles in bookstack, say admin)
to scopes and groups in IAM, e.g. bookstack_roles and bookstack_admin

add the scope to the oauth2 application

assign users to these groups as needed.

configure app which scope to use for roles

#iam #idm #oauth2 #roles #claim-map #kanidm

Ok, first time I tried to use a custom scope to map oauth2 users to application specific roles.
Followed some sample and I just replaced names.
Working with one role.. adding another. Both roles not working anymore.
Reading more theory about scopes and claims did help to understand (oh well 🙈)
It's actually not that complicated 🤓
Both roles working now. Writing up some docs and adding another 2 roles is planned for tomorrow.
#oauth2 #idm #kanidm

Bearer tokens are reusable. That’s the problem.

In Quarkus 3.32 you can now implement a custom DPoPNonceProvider and stop OAuth token replay attacks properly.

I built a full end-to-end example with:
- DPoP-bound tokens
- Nonce challenge-response
- Replay protection
- Keycloak Dev Services

Full walkthrough:
https://www.the-main-thread.com/p/quarkus-3-32-dpop-nonce-provider-java-replay-protection

#Quarkus #Java #OAuth2 #DPoP #APISecurity