Why not use an already built with Ueberauth Strategies? We accept a few in our SaaS, like Microsoft and Google.
pedromvieira
blatyo
Conduit Core Team
The goal would to allow single sign-on across multiple applications. So, we would have a provider that allows the user to login via other OAuth providers or our existing accounts. The other applications then direct the user to this application to login. The individual apps only need to support one OAuth provider as the only authentication strategy, rather than each implementing the same set and then also sharing our existing accounts somehow.
0
pedromvieira
That is still doable with a umbrella / microservices for centralized authentication, but sure, makes sense to build a new…
0
tangui
That’s true only if your applications do share the same hostname, as we are talking of cookie-based sessions and cookies won’t be sent to different hostnames.
OAuth is more for API access control (think mobile applications, SPAs and access delegation to third party apps), while OpenID Connect (an OAuth2 superset) is for delegated authentication (think SSO between web apps). It’s kind of the successor to SAML2. It may be what you’re looking for. I’d add CAS server (java) and Identity Server (.NET) to the list of open-source server supporting OAuth2, OpenID Connect and SAML2.
However as long as you can stick with using a web cookie-based session you might be better with that because these federation protocols add a whole new complexity to your stack.
1
blatyo
Conduit Core Team
Thanks for pointing me towards OpenID Connect. I’d seen it, but didn’t realize it was different from the OpenID of yesteryear, which was the URL as authentication mechanism.
Things are on the same domain for the time being. But I’ll still check it out.
0
blatyo
Conduit Core Team
A follow up to this thread. I ended up going with danschultzer/ex_oauth2_provider and it’s worked great.
2
pknoth
I update this thread with boruta | Hex, an OpenID certified provider that works great and provides quite a lot of customization possibilities.
You can also have a look at the source code GitHub - malach-it/boruta_auth: A yet complex but OpenID™ certified OAuth / OpenID Connect provider core · GitHub
0
pzingg
How about this one: README — Oidcc v3.7.2
Haven’t tried it yet, because it requires OTP 26/Elixir >=1.14.5 (uses new Erlang “maybe” expressions). There are also Phoenix plugs to handle OAuth2/OIDC endpoints.
0
pknoth
The package you mention is a client, the last version was supported by the EEF. Here we are speaking about the providers or the authorization servers, boruta is one of them.
0