search

volatiletech / authboss

The boss of http auth.
MIT License
3.79k stars 204 forks source link

oauth2 is not intended for Single Sign On #324

Closed restourgie closed 3 years ago

restourgie commented 3 years ago

I would like to inform you that oauth2 is not intended for Single Sign On.

Just to quote RFC6749: The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

The protocol you need to implement for Single Sign On is OpenID Connect: https://openid.net/specs/openid-connect-core-1_0.html The protocols are very much alike. For instance the authorisation code flow (the most secure and recommended) protocol only differs with the tokens you obtain from the OpenID Provider (an Identity Token on top of an Access Token)

aarondl commented 3 years ago

The idea is to have authboss enable your website to use say Github logins via oauth2 and retrieve information from Github to use on your site.

So having said that, I'm not sure why you're informing me that oauth2 is not used for single sign on. Is it because we attempt to coerce multiple different oauth2 accounts into the same database user?

restourgie commented 3 years ago

Ah ok! The use case is a valid one. The reason I got confused was because Authboss states that is an authentication system. Thus being able to support federated login (SSO) via either SAML2 or OIDC in both ways (as a 3rd party or providing sso for 3rd parties) sounds like a valid authentication use case. Authorisation on the other hand could be seen as a bit of a scope creep.

aarondl commented 3 years ago

Makes sense. Thanks for the comment.