<story><title>How Open ID Connect Works</title><url>https://blog.digger.dev/how-open-id-connect-works-illustrated/</url></story><parent_chain><item><author>grinich</author><text>Have you tried WorkOS? (I work there.)&lt;p&gt;Makes it super easy to add SAML&amp;#x2F;SCIM to your app. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;workos.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;workos.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;We also recently launched &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.authkit.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.authkit.com&amp;#x2F;&lt;/a&gt;</text></item><item><author>opportune</author><text>What’s insane to me is that it feels like nobody has actually managed to make this easy for developers yet. If they have, I don’t know about them.&lt;p&gt;I would normally consider myself pretty competent, but I stood up my first fully featured website recently with logins and such, and it took me about 2 days of work to get AWS Cognito working (using their recommended USER_SRP_AUTH). That’s not including 3rd party login functionality from Google and friends.&lt;p&gt;Their documentation and UX is piss-poor unless you’re willing to onboard your entire project to Amplify and enter npm-hell, which I wasn’t. It’s almost like they don’t even want your business.&lt;p&gt;I looked into using Auth0 instead and it didn’t seem to be any easier. Better docs, seems like they’re actually written by someone who both understands the auth problem domain and how to explain it to those that don’t, but still complex.&lt;p&gt;Yet when I was finished finally getting everything to work, it seems like the kind of thing you could easily package into an off-the-shelf product. It’s just that existing products don’t do it. Like why the fuck is there a guide explaining how to write a lambda to convert access codes to refresh tokens and persist them via cookies? That should be part of the Cognito platform!&lt;p&gt;Honestly thinking of just starting my own auth SAAS with blackjack and hookers</text></item><item><author>munchbunny</author><text>OIDC (and the rest of the OAuth umbrella of stuff) is one category where every time I have to work with the protocols I think &amp;quot;there must be a less confusing way&amp;quot; and then have a failure of imagination for a simpler way to accomplish the same thing. I think it&amp;#x27;s because the protocols are conceptually simple, but the cryptographic parts, especially the PKI parts, make them intricate to understand exactly who is attesting or validating exactly what.</text></item></parent_chain><comment><author>alberth</author><text>&amp;gt; &lt;i&gt;&amp;quot;I work there&amp;quot;&lt;/i&gt;&lt;p&gt;You don&amp;#x27;t just work there, aren&amp;#x27;t you the founder? :)&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=22607030&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=22607030&lt;/a&gt;</text></comment>
<story><title>How Open ID Connect Works</title><url>https://blog.digger.dev/how-open-id-connect-works-illustrated/</url></story><parent_chain><item><author>grinich</author><text>Have you tried WorkOS? (I work there.)&lt;p&gt;Makes it super easy to add SAML&amp;#x2F;SCIM to your app. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;workos.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;workos.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;We also recently launched &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.authkit.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.authkit.com&amp;#x2F;&lt;/a&gt;</text></item><item><author>opportune</author><text>What’s insane to me is that it feels like nobody has actually managed to make this easy for developers yet. If they have, I don’t know about them.&lt;p&gt;I would normally consider myself pretty competent, but I stood up my first fully featured website recently with logins and such, and it took me about 2 days of work to get AWS Cognito working (using their recommended USER_SRP_AUTH). That’s not including 3rd party login functionality from Google and friends.&lt;p&gt;Their documentation and UX is piss-poor unless you’re willing to onboard your entire project to Amplify and enter npm-hell, which I wasn’t. It’s almost like they don’t even want your business.&lt;p&gt;I looked into using Auth0 instead and it didn’t seem to be any easier. Better docs, seems like they’re actually written by someone who both understands the auth problem domain and how to explain it to those that don’t, but still complex.&lt;p&gt;Yet when I was finished finally getting everything to work, it seems like the kind of thing you could easily package into an off-the-shelf product. It’s just that existing products don’t do it. Like why the fuck is there a guide explaining how to write a lambda to convert access codes to refresh tokens and persist them via cookies? That should be part of the Cognito platform!&lt;p&gt;Honestly thinking of just starting my own auth SAAS with blackjack and hookers</text></item><item><author>munchbunny</author><text>OIDC (and the rest of the OAuth umbrella of stuff) is one category where every time I have to work with the protocols I think &amp;quot;there must be a less confusing way&amp;quot; and then have a failure of imagination for a simpler way to accomplish the same thing. I think it&amp;#x27;s because the protocols are conceptually simple, but the cryptographic parts, especially the PKI parts, make them intricate to understand exactly who is attesting or validating exactly what.</text></item></parent_chain><comment><author>aidos</author><text>I had a look at this recently and the pricing was pretty wild. Am I right in understanding that the connection charge is effectively per organisation?</text></comment>