Hacker News new | ask | show | jobs
by korethr 1771 days ago
What options for addressing the SSO problem would you recommend over SAML if one had the option? OIDC? Kerberos?
2 comments

OIDC for everything.

Kerberos is limited to internal network and some very specific use cases (desktop auth). It's not competing.

If the company has fully integrated Active Directory/Kerberos. On any desktop computer, it's possible to get an OIDC/JWT token for the current user with a single API call. It's transparent, the user doesn't need to enter their password because they are already authenticated on the machine. That is to say, no application ever needs to support Kerberos in the current age.

We recommend OIDC, but support SAML because customers.

We implemented our own SAML processing library, too: https://github.com/FusionAuth/fusionauth-samlv2

(We pay for valid security bugs.)