#oidc

Nik | Klampfradler 🎸🚲I got back to <a href="https://toot.teckids.org/tags/WebIDAMd" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebIDAMd</a>, a <a href="https://toot.teckids.org/tags/systemd" class="mention hashtag" rel="nofollow noopener" target="_blank">#systemd</a>-userdbd-based system for using <a href="https://toot.teckids.org/tags/OAuth" class="mention hashtag" rel="nofollow noopener" target="_blank">#OAuth</a> / <a href="https://toot.teckids.org/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> / <a href="https://toot.teckids.org/tags/REST" class="mention hashtag" rel="nofollow noopener" target="_blank">#REST</a> identity providers for <a href="https://toot.teckids.org/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> system authentication.And I can now show off a first demo (no <a href="https://toot.teckids.org/tags/PAM" class="mention hashtag" rel="nofollow noopener" target="_blank">#PAM</a> authentication yet, but user and group listing):<a href="https://asciinema.org/a/728567" rel="nofollow noopener" translate="no" target="_blank">https://asciinema.org/a/728567</a>In contrast to <a href="https://toot.teckids.org/tags/sssd" class="mention hashtag" rel="nofollow noopener" target="_blank">#sssd</a>'s recent OIDC module, WebIDAMd is fully provider-agnostic and integrates transparently with userdbd, the current/upcoming standard in most Linux distributions instead of requiring a full separate software stack.

DocYeet :verified:I've been progressively more and more frustrated with Zitadel as Identity Provider in the last monthsIt came with the default Netbird installation process and thought I would use Zitadel as my Identity Provider for the whole infrastructure, learning with itBut it feels clunky, slow and overly complicated, so I am here to ask you, is it a me thing or is Zitadel actually not so polished ?I am currently eying Authentik and have to run some tests before migrating but I would be curious to hear your feedback on the matter<a href="https://mastodon.halis.io/tags/selfhosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosted</a> <a href="https://mastodon.halis.io/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> <a href="https://mastodon.halis.io/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://mastodon.halis.io/tags/zitadel" class="mention hashtag" rel="nofollow noopener" target="_blank">#zitadel</a> <a href="https://mastodon.halis.io/tags/netbird" class="mention hashtag" rel="nofollow noopener" target="_blank">#netbird</a> <a href="https://mastodon.halis.io/tags/authentik" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentik</a> <a href="https://mastodon.halis.io/tags/idp" class="mention hashtag" rel="nofollow noopener" target="_blank">#idp</a> <a href="https://mastodon.halis.io/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>

Elias Probst<a href="https://gruene.social/@Gerbsen" class="u-url mention" rel="nofollow noopener" target="_blank">@Gerbsen</a> es gibt einen Fork von <a href="https://mastodon.social/tags/Vaultwarden" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vaultwarden</a> mit <a href="https://mastodon.social/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a>-Support, aber der Maintainer hat gerade erst seinen Hauptsponsor verloren, weshalb zwar der Fork weiter maintained wird, aber die Releases evtl. immer etwas hinter dem Original hinterherhinken: <a href="https://github.com/dani-garcia/vaultwarden/pull/3899" rel="nofollow noopener" translate="no" target="_blank">https://github.com/dani-garcia/vaultwarden/pull/3899</a>

Silke MeyerFür "Identity Broker"-Szenarien mit Keycloak finde ich die Doku von Red Hat empfehlenswert. Dort ist verhältnismäßig gut beschrieben, wie man das Durchreichen von Claims/Attributen von einem Identity Provider durch einen anderen zu einem Client konfiguriert.<a href="https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html/server_administration_guide/identity_broker" rel="nofollow noopener" translate="no" target="_blank">https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html/server_administration_guide/identity_broker</a><a href="https://univention.social/tags/keycloak" class="mention hashtag" rel="nofollow noopener" target="_blank">#keycloak</a> <a href="https://univention.social/tags/singlesignon" class="mention hashtag" rel="nofollow noopener" target="_blank">#singlesignon</a> <a href="https://univention.social/tags/iam" class="mention hashtag" rel="nofollow noopener" target="_blank">#iam</a> <a href="https://univention.social/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://univention.social/tags/saml" class="mention hashtag" rel="nofollow noopener" target="_blank">#saml</a>

Gauff 🇪🇺<a href="https://fosstodon.org/@adingbatponder" class="u-url mention" rel="nofollow noopener" target="_blank">@adingbatponder</a> If possible, setup <a href="https://piaille.fr/tags/wireguard" class="mention hashtag" rel="nofollow noopener" target="_blank">#wireguard</a> yourself, there are some very good guides: <a href="https://docs.pi-hole.net/guides/vpn/wireguard/server/" rel="nofollow noopener" translate="no" target="_blank">https://docs.pi-hole.net/guides/vpn/wireguard/server/</a>If you really wish to use <a href="https://piaille.fr/tags/tailscale" class="mention hashtag" rel="nofollow noopener" target="_blank">#tailscale</a> , I believe they offer the feature to have a <a href="https://piaille.fr/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkey</a> , or <a href="https://piaille.fr/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> ?

Lenin alevski 🕵️💻New Open-Source Tool Spotlight 🚨🚨🚨Pocket ID is an OIDC provider simplifying authentication with passkeys. No passwords. Think secure logins using Yubikeys or biometrics. Lightweight compared to Keycloak or Hydra and ideal for focused use cases. Built for Docker setups. <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a>🔗 Project link on <a href="https://infosec.exchange/tags/GitHub" class="mention hashtag" rel="nofollow noopener" target="_blank">#GitHub</a> 👉 <a href="https://github.com/pocket-id/pocket-id" rel="nofollow noopener" translate="no" target="_blank">https://github.com/pocket-id/pocket-id</a><a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/Software" class="mention hashtag" rel="nofollow noopener" target="_blank">#Software</a> <a href="https://infosec.exchange/tags/Technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#Technology</a> <a href="https://infosec.exchange/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#News</a> <a href="https://infosec.exchange/tags/CTF" class="mention hashtag" rel="nofollow noopener" target="_blank">#CTF</a> <a href="https://infosec.exchange/tags/Cybersecuritycareer" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecuritycareer</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#redteam</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a> <a href="https://infosec.exchange/tags/purpleteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#purpleteam</a> <a href="https://infosec.exchange/tags/tips" class="mention hashtag" rel="nofollow noopener" target="_blank">#tips</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/cloudsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cloudsecurity</a>— ✨ 🔐 P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 💻🏴‍☠️

Silke MeyerGuten Morgen! Am 11. Juni findet wieder meine ganztägige Keycloak-Schulung statt und es gibt noch ein paar freie Plätze. Die Zielgruppe sind Admin*s, die den von <a href="https://univention.social/@univention" class="u-url mention" rel="nofollow noopener" target="_blank">@univention</a> ausgelieferten Keycloak in Verbindung mit UCS einsetzen. SSO-Vorkenntnisse sind nicht nötig. Falls noch jemand teilnehmen möchte, sind hier die Details zur Anmeldung:<a href="https://www.univention.de/training/keycloak/" rel="nofollow noopener" translate="no" target="_blank">https://www.univention.de/training/keycloak/</a><a href="https://univention.social/tags/Keycloak" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keycloak</a> <a href="https://univention.social/tags/singlesignon" class="mention hashtag" rel="nofollow noopener" target="_blank">#singlesignon</a> <a href="https://univention.social/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://univention.social/tags/saml" class="mention hashtag" rel="nofollow noopener" target="_blank">#saml</a> <a href="https://univention.social/tags/univention" class="mention hashtag" rel="nofollow noopener" target="_blank">#univention</a>

Vladimir MarinkovicBlogged: kickstarter guide for using Keycloak as identity provider<a href="https://cleverheap.com/posts/keycloak-with-aspnet-webapi/" rel="nofollow noopener" translate="no" target="_blank">https://cleverheap.com/posts/keycloak-with-aspnet-webapi/</a><a href="https://mastodon.social/tags/keycloak" class="mention hashtag" rel="nofollow noopener" target="_blank">#keycloak</a> <a href="https://mastodon.social/tags/blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#blog</a> <a href="https://mastodon.social/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a> <a href="https://mastodon.social/tags/aspnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#aspnet</a> <a href="https://mastodon.social/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://mastodon.social/tags/oauth2" class="mention hashtag" rel="nofollow noopener" target="_blank">#oauth2</a>

gyptazyProxmox in Enterprises: I'm often asked, 'Can we use our Active Directory, LDAP, or OIDC with Proxmox?' Yes, you can!Let's have quick dive into installing and configuring Authentik and configure Proxmox VE to use OIDC as an additional authentication realm.<a href="https://mastodon.gyptazy.com/tags/Proxmox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Proxmox</a> <a href="https://mastodon.gyptazy.com/tags/ProxmoxVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#ProxmoxVE</a> <a href="https://mastodon.gyptazy.com/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://mastodon.gyptazy.com/tags/Authentik" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentik</a> <a href="https://mastodon.gyptazy.com/tags/OpenID" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenID</a> <a href="https://mastodon.gyptazy.com/tags/OpenIDConnect" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenIDConnect</a> <a href="https://mastodon.gyptazy.com/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> <a href="https://mastodon.gyptazy.com/tags/EntraID" class="mention hashtag" rel="nofollow noopener" target="_blank">#EntraID</a> <a href="https://mastodon.gyptazy.com/tags/enterprise" class="mention hashtag" rel="nofollow noopener" target="_blank">#enterprise</a> <a href="https://mastodon.gyptazy.com/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a><a href="https://gyptazy.com/proxmox-authentik-oidc-install-configure-and-connect-authentik-to-proxmox-ve/" rel="nofollow noopener" translate="no" target="_blank">https://gyptazy.com/proxmox-authentik-oidc-install-configure-and-connect-authentik-to-proxmox-ve/</a>

F. Maury ⏚Me to the library: Please verify the signature of this document. Library: Document is OK. Me: What keys did you use exactly? Library: What keys? Me: ... Library: Well, I did not have any keys so I did not really check. Me: 😠<a href="https://infosec.exchange/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

Felicitas Pojtinger 🌅Finally managed to get <a href="https://mastodon.social/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> post-login redirects to specific "URLs" (well, <a href="https://mastodon.social/tags/libadwaita" class="mention hashtag" rel="nofollow noopener" target="_blank">#libadwaita</a> `NavigationView` tags, to be precise) to work. That was quite a bit more complex than I expected it to be!

Markus EiseleSender-constraining access tokens with Quarkus OIDC <a href="https://quarkus.io/blog/sender-constraining-tokens/" rel="nofollow noopener" translate="no" target="_blank">https://quarkus.io/blog/sender-constraining-tokens/</a> <a href="https://mastodon.online/tags/Java" class="mention hashtag" rel="nofollow noopener" target="_blank">#Java</a> <a href="https://mastodon.online/tags/Quarkus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Quarkus</a> <a href="https://mastodon.online/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> <a href="https://mastodon.online/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a>

FluchtkapselIch glaube, ich kann mittlerweile nicht mehr guten Gewissens zu Webdiensten raten, die kein OpenID Connect unterstützen.Ich bin ein Freund spezialisierter Software: Mach ein Ding, mach es ordentlich, sei interoperabel. Mängel einer Software können dann durch Stärken einer anderen ausgeglichen werden. Aber wenn ein bunter Strauß verschiedener Webdienste im Einsatz sind, möchte man sich so einfach wie möglich anmelden, was derzeit wohl noch immer Social Logins auf Basis von OAuth 2 oder OpenID Connect sind.Mein <a href="https://nerdculture.de/tags/Mattermost" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mattermost</a> hat deswegen enorm an Reiz für mich verloren, weil es nur Anmeldung via Gitlab erlaubt. <a href="https://nerdculture.de/tags/Vernissage" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vernissage</a> oder <a href="https://nerdculture.de/tags/Pixelfed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pixelfed</a> sind für mich uninteressant, solange ich dort kein <a href="https://nerdculture.de/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> konfigurieren kann.Und ja, für mich gilt das aus Benutzersicht wie auch aus Perspektive des Admins, der die Dienste selbst betreibt.

ArielI'm confused how a static site can do OIDC.Isn't there supposed to be a client/application ID-secret pair that are used to exchange the auth token for the actual access token that /does/ stuff?How do you store that secret when it's all static files and client-side JS calls?<a href="https://eigenmagic.net/tags/FrontEnd" class="mention hashtag" rel="nofollow noopener" target="_blank">#FrontEnd</a> <a href="https://eigenmagic.net/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a>

damienbodNew Microsoft docs: Configure JWT bearer authentication in ASP.NET Core<a href="https://learn.microsoft.com/aspnet/core/security/authentication/configure-jwt-bearer-authentication" rel="nofollow noopener" translate="no" target="_blank">https://learn.microsoft.com/aspnet/core/security/authentication/configure-jwt-bearer-authentication</a><a href="https://mastodon.social/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://mastodon.social/tags/aspnetcore" class="mention hashtag" rel="nofollow noopener" target="_blank">#aspnetcore</a> <a href="https://mastodon.social/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a> <a href="https://mastodon.social/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://mastodon.social/tags/bearer" class="mention hashtag" rel="nofollow noopener" target="_blank">#bearer</a> <a href="https://mastodon.social/tags/authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#authorization</a> <a href="https://mastodon.social/tags/access" class="mention hashtag" rel="nofollow noopener" target="_blank">#access</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>Thanks Mike Kistler Rick Anderson Stephen Halter

FluchtkapselEigentlich wollte ich ja heute mal <a href="https://nerdculture.de/tags/Vernissage" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vernissage</a> und <a href="https://nerdculture.de/tags/GoToSocial" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoToSocial</a> installieren. Aber dann fiel mir ein, dass ich das ja an mein <a href="https://nerdculture.de/tags/Keycloak" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keycloak</a> anbinden könnte. Und außerdem war da ja noch <a href="https://nerdculture.de/tags/Mobilizon" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mobilizon</a>, was nicht mehr wollte.Also erstmal Mobilizon repariert. Dabei stelle ich fest, dass auch Mobilizon <a href="https://nerdculture.de/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> unterstützt, also kann ich auch das an Keycloak anbinden.Muss nor noch schauen, ob Vernissage auch OIDC unterstützt. Außerdem bin ich in Sachen Keycloak seit letztem Frühjahr ein wenig eingerostet. Hoffe, ich kriege das alles noch zusammen.

Josef Davies-CoatesHey <a href="https://mastodon.xyz/@nextcloud" class="u-url mention" rel="nofollow noopener" target="_blank">@nextcloud</a> are there any plans to bake in <a href="https://mastodon.uniteddiversity.coop/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> into <a href="https://mastodon.uniteddiversity.coop/tags/Nextcloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#Nextcloud</a> itself in the same way LDAP is? Most of my apps now use OIDC and it's be great to be able to use it with Nextcloud too (which out having to risk using a third party app to do it, which seems risk for something so fundamental as login).

Tom ChappleWhat's the fediverse's opinion on <a href="https://mastodon.social/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> providers for identifying applications at runtime? For example: a GitHub workflow assuming a role in AWS using an OIDC token it can retrieve by making a cURL request internally.<a href="https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services" rel="nofollow noopener" translate="no" target="_blank">https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services</a>I feel like it would be great to utilise that functionality to avoid storing static credentials, but I'm curious what other people think on this. Maybe there's some security aspect I'm not considering?<a href="https://mastodon.social/tags/Programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#Programming</a> <a href="https://mastodon.social/tags/CICD" class="mention hashtag" rel="nofollow noopener" target="_blank">#CICD</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.social/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a>

Pelle WessmanIts a bit weird that <a href="https://mastodon.social/tags/GitHub" class="mention hashtag" rel="nofollow noopener" target="_blank">#GitHub</a> spearheaded <a href="https://mastodon.social/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> based authentication to retrieve short lived tokens for cloud platforms and then <a href="https://mastodon.social/tags/PyPi" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPi</a>, <a href="https://mastodon.social/tags/RubyGems" class="mention hashtag" rel="nofollow noopener" target="_blank">#RubyGems</a> and even <a href="https://mastodon.social/tags/Dart" class="mention hashtag" rel="nofollow noopener" target="_blank">#Dart</a> went and used that to enable short lived tokens for publishing packages – but GitHub themselves haven't yet launched it for <a href="https://mastodon.social/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#npm</a><a href="https://social.lfx.dev/@openssf" class="u-url mention" rel="nofollow noopener" target="_blank">@openssf</a> has even launched a <a href="https://mastodon.social/tags/TrustedPublishers" class="mention hashtag" rel="nofollow noopener" target="_blank">#TrustedPublishers</a> guideline: <a href="https://repos.openssf.org/trusted-publishers-for-all-package-repositories" rel="nofollow noopener" translate="no" target="_blank">https://repos.openssf.org/trusted-publishers-for-all-package-repositories</a><a href="https://blog.rubygems.org/2023/12/14/trusted-publishing.html" rel="nofollow noopener" translate="no" target="_blank">https://blog.rubygems.org/2023/12/14/trusted-publishing.html</a>

Max Maass :donor:Oh wow, I completely missed that <a href="https://infosec.exchange/tags/KeyConf" class="mention hashtag" rel="nofollow noopener" target="_blank">#KeyConf</a> is happening. Looks like a bunch of really interesting talks on <a href="https://infosec.exchange/tags/Keycloak" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keycloak</a> and <a href="https://infosec.exchange/tags/OAuth" class="mention hashtag" rel="nofollow noopener" target="_blank">#OAuth</a> / <a href="https://infosec.exchange/tags/OIDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#OIDC</a> are being presented there. Looking forward to watching the recordings. <a href="https://fosstodon.org/@ahus1/113159868562052066" rel="nofollow noopener" translate="no" target="_blank">https://fosstodon.org/@ahus1/113159868562052066</a>

Recent searches

Search options

Administered by:

Server stats: