<story><title>OAuth Has Ruined Everything</title><url>http://developer.telerik.com/featured/oauth-has-ruined-everything/?imm_mid=0dac54&amp;cmp=em-web-na-na-newsltr_20151021</url></story><parent_chain><item><author>nickbauman</author><text>Agree. SAML is crazy complicated.</text></item><item><author>broodbucket</author><text>I don&amp;#x27;t think this is a good critique of OAuth at all.&lt;p&gt;First of all, the majority of complaints aren&amp;#x27;t even about OAuth, they&amp;#x27;re about (a specific implementation of consuming) OpenID Connect, which it doesn&amp;#x27;t seem like the author realises he&amp;#x27;s using.  JWTs aren&amp;#x27;t in OAuth 2.0.&lt;p&gt;If the author had realised this, surely when looking for libraries to assist with the project he would&amp;#x27;ve looked for an OIDC or JWT library instead of something specific to Google.  There are plenty of library recommendations on the JWT website[1], including .NET.&lt;p&gt;It&amp;#x27;s not like OAuth 2.0 or OIDC are trivial to use, but these aren&amp;#x27;t easy problems to solve.  OpenID Connect is young, and there&amp;#x27;s still a lot lacking in terms of library support and (probably more importantly) documentation.&lt;p&gt;I&amp;#x27;d rather deal with the rough edges of OIDC than use SAML any day of the week.&lt;p&gt;[1]: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;jwt.io&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;jwt.io&lt;/a&gt;</text></item></parent_chain><comment><author>volkadav</author><text>The entire spec, yes, is big, but the part you actually &lt;i&gt;need&lt;/i&gt; is not that complicated. I implemented the IdP for the new york times (there&amp;#x27;s quite a bit of third party shit plugged into the nytimes.com web experience that we wanted to be transparent to users) in a few weeks as I recall, and I&amp;#x27;m not some coding super-genius. (It was kinda hacktified and minimalistic, but it worked at scale. ¯\_(ツ)_&amp;#x2F;¯)  Most of our counter-parties were up and running in a week or so. Compared to the abysmal quagmire that was our ecommerce code, SAML implementation was a total milk run.</text></comment>
<story><title>OAuth Has Ruined Everything</title><url>http://developer.telerik.com/featured/oauth-has-ruined-everything/?imm_mid=0dac54&amp;cmp=em-web-na-na-newsltr_20151021</url></story><parent_chain><item><author>nickbauman</author><text>Agree. SAML is crazy complicated.</text></item><item><author>broodbucket</author><text>I don&amp;#x27;t think this is a good critique of OAuth at all.&lt;p&gt;First of all, the majority of complaints aren&amp;#x27;t even about OAuth, they&amp;#x27;re about (a specific implementation of consuming) OpenID Connect, which it doesn&amp;#x27;t seem like the author realises he&amp;#x27;s using.  JWTs aren&amp;#x27;t in OAuth 2.0.&lt;p&gt;If the author had realised this, surely when looking for libraries to assist with the project he would&amp;#x27;ve looked for an OIDC or JWT library instead of something specific to Google.  There are plenty of library recommendations on the JWT website[1], including .NET.&lt;p&gt;It&amp;#x27;s not like OAuth 2.0 or OIDC are trivial to use, but these aren&amp;#x27;t easy problems to solve.  OpenID Connect is young, and there&amp;#x27;s still a lot lacking in terms of library support and (probably more importantly) documentation.&lt;p&gt;I&amp;#x27;d rather deal with the rough edges of OIDC than use SAML any day of the week.&lt;p&gt;[1]: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;jwt.io&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;jwt.io&lt;/a&gt;</text></item></parent_chain><comment><author>notwhereyouare</author><text>Yep. Spent basically 2 months trying to implement saml manually. We had kinda a working implementation for something else. Tried to use it. Didn&amp;#x27;t work. Ended up finding a solution that somebody published. Modified and got working for my situation. It sucked and put me really behind schedule. Doesn&amp;#x27;t matter. The other members of the project were ever further behind</text></comment>