Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not only what tptacek said, but it's somewhat related to NIH syndrome. People look at the specs for standards like OpenID, OAuth or SAML2; think it's way too complex; and decide they can write something much simpler to suit their needs. After dealing SAML myself for a couple years, I agree it's huge and possibly over-engineered, but it also has years of work put into it, and there are well-tested implementations that you can use, just maybe not in your favorite language.

Note: I'm talking about Web-SSO. Host SSO pretty much consists of LDAP+Krb5 (which is the basis of Active Directory authentication), or just LDAP. Everything else is pretty much dead, though NIS still sticks around the *nix world due to it's ease of configuration.



With a lot less experience to you I can relate to the NIH syndrome, but I don't think it's just the specs, it's the resulting implementations. Just go look at the .Net one that everyone recommends you use:

https://github.com/AArnott/dotnetopenid/tree/master/src

Over-engineered specs seemingly result in over-engineered code. Not that I really get why they made the client and the provider one big project in the first place.

Having mucked around with OAuth on a couple of .Net projects it's just a nightmare to use. If something goes wrong and you try and dive into that code, woe betide you. It's like a rabbit warren. Just to figure out you aren't properly encoding the &s or something.

Having used the v3 calendar API recently it's interesting to see Google now just release essentially very simple libraries that just deal with the integration for you. It's like even they've given up trying to get people to use OAuth, where the google groups were littered with 'can't get auth working' and so just hand-wave over it.

Personally I think it's at the SOAP stage that data exchange formats went through, sounds simple but somehow is extremely complex. I'm hoping that the JSON equivalent will come out soon.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: