#OAuth

I made my plea for such a setup in the #fediverse three years ago, but since then most of the innovation in this space has happened in and around the AT protocol, which consequently pulled my attention towards that space.

However what's emerging here isn't specific to any one protocol, and #ActivityPub is neatly aligned IdP-agnostic web logins.

https://socialhub.activitypub.rocks/t/autonomous-identity-for-the-pluriverse-based-on-oauth-oidc/3675?u=erlend_sh

#oauth #fedcm #decentralized #indieweb

@hongminhee

Well, after the issues with the given ActivityPub "OAuth example", I looked up
@fedify /vocab …

In all the actor types like https://github.com/fedify-dev/fedify/blob/main/packages/vocab/src/person.yaml

the following properties would be missing [if the official OAuth demo should work] :

grant_types_supported: ['authorization_code'],

response_types_supported:
['code', 'code token'],

code_challenge_methods_supported: ['S256'],
token_endpoint_auth_methods_supported: [
'client_secret_basic'
// optional
/*, 'private_key_jwt'*/
],
token_endpoint_auth_signing_alg_values_supported: ['RS256', 'ES256'],
client_id_metadata_document_supported: true,

optional
scopes_supported and ui_locales_supported:

---

anyway:
I believe it is just misleading because of the order of querying the server and the actor description.

I would expect it to meet the spec and pull above properties from the server wide .well-known oauth and just the endpoints from the Actor …

#ActivityPub #OAuth

I'm attempting to delegate management of service accounts/machines to Entra upstream of Keycloak. The idea is they can use client credentials flow for unattended/programmatic access, get the JWT, then exchange that token with Keycloak who trusts their issuer in the JWT authorization grant flow.

Firstly, it seems Entra *will not* issue an ID token for an App Registration (approximately an OIDC client) - not even for a VM with IMDS.

I can get an access token using client credentials flow fine, but when I present this to Keycloak for a JWT authorization grant, it bombs saying user not found. This is correct as that subject claim does not have a corresponding Keycloak user entry.

If I have to set up a user with matching ID for every Entra client, it defeats most of the benefit of delegation.

Should I be able to have Keycloak mint an access token with an unknown subject ID? I mean it does uniquely identify a principal in context of the upstream Identity Provider.

Thoughts? Ideas?

#Oauth #OIDC #Oauth2

Verehrtes #Fediverse –

die #ActivityPub #ClientToServer API ist magisch.
Für menschy setzen wir momentan die neuen Spezifikationen um.
Zum Beispiel

Auth
https://
swicg.github.io/activitypub-api/basicprofile
with according
Metadata https://
client.dev/
and example in https://
github.com/swicg/activitypub-api

Seek
https://
swicg.github.io/activitypub-api/seekitem

Autocomplete
https://
swicg.github.io/activitypub-api/autocomplete

Server Sent Events
https://
swicg.github.io/activitypub-api/sse

HTML Discovery
https://swicg.github.io/activitypub-html-discovery/

#fedidev #oauth #seek #autocomplete #sse #discovery #c2s

Esteemed #Fediverse –

the #ActivityPub #ClientToServer API is magic.
For menschys we are currently implementing the new specs.
There are multiple drafts already, e.g.

Auth
https://swicg.github.io/activitypub-api/basicprofile
with according
Metadata https://client.dev/
and example in https://github.com/swicg/activitypub-api

Seek
https://swicg.github.io/activitypub-api/seekitem

Autocomplete
https://swicg.github.io/activitypub-api/autocomplete

Server Sent Events
https://swicg.github.io/activitypub-api/sse

HTML Discovery
https://swicg.github.io/activitypub-html-discovery/

#fedidev #oauth #seek #autocomplete #discovery #c2s

/ @clemensg

@hongminhee @fedify

Hey there,
this is about the new #ActivityPub C2S specs. introducing new properties.

In https://swicg.github.io/activitypub-api/basicprofile#discovery – the according example https://swicg.github.io/activitypub-api/examples/oauth/index.html expects the properties to be either in the /.well-known/oauth-authorization-server or in the Actor.

How can I support them in Actors created by fedify, e.g. in an ActorDispatcher ?
Maybe they should be defined in the default context …
#fedify #oauth

@aaronpk

Question about the according example to https://swicg.github.io/activitypub-api/basicprofile –
did the "server.js" file disappear?

#oauth example;
I am using it with #fedify anyway already but it might be helpful for others to mention the "server counterparts" of the used (thankfully Okta sponsored ;) `oauth4webapi` cause it's modern, uses Web API and works in all the js runtimes serverside …

@fentiger

just btw;
I hope, all of this will make my IndieWebCamp Brighton demo of broken registerProtocolHandlers obsolete :)
https://www.youtube.com/live/W70wd56i0Bg?t=2030s

@jaffathecake
Once I had BrowserId then the renamed Persona then WebId and now it is https://developer.mozilla.org/de/docs/Web/API/FedCM_API I suppose.
Demos https://fedcm-demo-rp.dev/menu
Some articles said that Firefox will ship it in 2025 / 2026 - is that still true ?

#indieweb #indieauth #activitypub #federation #oauth

Currently implementing the Federated Credential Management API
https://w3c-fedid.github.io/FedCM/

Flow and Benefits
https://www.corbado.com/blog/fedcm-federated-credential-management-api

Funny Quote
„Axel Springer (Welt, Bild): German media giant with full FedCM deployment:
- 14x increase in monthly registrations after implementing FedCM“

#FedCM #OAuth #cimd #ActivityPub #fedidev

I was really happy to see @benpate and @dansup exploring similar ideas at the last FediCon: reducing user friction and making onboarding to the Fediverse almost invisible.

I’ve been working along the same lines. Here’s a small example: a user can interact with a #BadgeFed instance by simply logging in with #LinkedIn or #GitHub.

They can comment, upload images, like, boost, etc. They don’t need to know what the Fediverse is, what an instance is, or what software is running underneath.

For them, it’s just a social app.

Of course, existing Fediverse users can still connect with their Mastodon account or use their preferred Fediverse software.

Under the hood, it’s a #GoToSocial account configured with LinkedIn/GitHub OIDC OAuth.

But to the user? Completely transparent.

I think this kind of invisible complexity is one of the ways we can make the Fediverse much more approachable without sacrificing interoperability.

#Fediverse #ActivityPub #Mastodon #OpenWeb #Decentralization #OAuth

I was really happy to see @benpate and @dansup exploring similar ideas at the last FediCon: reducing user friction and making onboarding to the Fediverse almost invisible.

I’ve been working along the same lines. Here’s a small example: a user can interact with a #BadgeFed instance by simply logging in with #LinkedIn or #GitHub.

They can comment, upload images, like, boost, etc. They don’t need to know what the Fediverse is, what an instance is, or what software is running underneath.

For them, it’s just a social app.

Of course, existing Fediverse users can still connect with their Mastodon account or use their preferred Fediverse software.

Under the hood, it’s a #GoToSocial account configured with LinkedIn/GitHub OIDC OAuth.

But to the user? Completely transparent.

I think this kind of invisible complexity is one of the ways we can make the Fediverse much more approachable without sacrificing interoperability.

#Fediverse #ActivityPub #Mastodon #OpenWeb #Decentralization #OAuth

#ActivityPub

Yesterday I implemented #cimd for the #OAuth and for Client-To-Server SignUp.

Overview https://client.dev/
(click the 'Explore' things for security hints)
because https://github.com/swicg/activitypub-api/issues/1

Technically it is easy, just wanted a nice UI for Client-To-Server so any client can combine it with the webmanifest and servers for menschys, redaktor etc. will support the dark/light things and the properties theme_color and background_color as well …

PS:
For Germans the letter order in the acronym is easy to remember: It is cinnamon for the OAuth sugar [Zimt] ;)

#Keycloak question: is there a way to allow multiple service accounts/machines to use one OIDC client?

Normally we'd go one OIDC client in confidential mode with the service account using client credentials flow - per machine access.

However, each OIDC client/service account means a new OIDC audience - and AWS has a hard limit of 100.

Direct Access grant flow is deprecated already and removed entirely I think from Oauth2.1 spec in strict mode.

Maybe we could just create users to represent the machines - but we'd have to find a way to exempt them from Realm policies like MFA etc and it still feels icky.

CC @4censord #OIDC #Oauth #Oauth2

Any fediverse developers with too much free time on their hands interested in helping me figure out why, when logging in with a Friendica account, I get an "Unprocessable Entity" error?

https://github.com/stefanbohacek/auth-server

#fediverse #oauth #friendica #fedidevs #nodejs #opensource

How would a client know that an rfc-8414 (oauth) server supports Client ID Metadata Documents (CIMD)?

#oauth #cimd

🆕 blog! “Adding OpenStreetMap login to Auth0”

So you want to add OSM as an OAuth provider to Auth0? Here's a tip - you do not want to create a custom social connection!

Instead, you need to create an "OpenID Connect" provider. Here's how.

OpenSteetMap

As per the OAuth documentation you will need to:

Register a new app at…

👀 Read more: https://shkspr.mobi/blog/2026/02/adding-openstreetmap-login-to-auth0/
⸻
#Auth0 #developers #oauth #OpenStreetMap

🆕 blog! “Adding OpenStreetMap login to Auth0”

So you want to add OSM as an OAuth provider to Auth0? Here's a tip - you do not want to create a custom social connection!

Instead, you need to create an "OpenID Connect" provider. Here's how.

OpenSteetMap

As per the OAuth documentation you will need to:

Register a new app at…

👀 Read more: https://shkspr.mobi/blog/2026/02/adding-openstreetmap-login-to-auth0/
⸻
#Auth0 #developers #oauth #OpenStreetMap

In which, Blaine Cook ( @blaine ) explains "What is OAuth?" in the framing not of standards and specifications, nor in technical terms, but instead in this framing:

> “What I need is to understand why it is designed this way, and to see concrete examples of use cases that motivate the design”

https://leaflet.pub/p/did:plc:3vdrgzr2zybocs45yfhcr6ur/3mfd2oxx5v22b/

#oauth #oauth2 #oidc

New post - keyless access to AWS from GCP. Handy to avoid IAM users and long-lived access keys.

https://www.richtman.au/blog/keyless-aws-access-gcp/

#GCP #AWS #Oauth #OIDC #Oauth2 #Cloud

Ooooh! ID-JAG or OAuth Identity Assertion JWT Authorization Grants looks interesting: https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-01.html

#oauth

If you're wondering what these documents look like, here's an example:
https://cimd-service.fly.dev/clients/bafyreidxk6lscepiy3lxtev7jag67s2taiyhk3gwazfd4khivaejsfyipq

#oauth

Built a little thing over the past ~20 hours:

A service for provisioning public Client ID Metadata Documents for use in development environments where you aren't publicly on the web.

https://cimd-service.fly.dev/

#oauth

Okay, so, I finally built that OAuth Client ID Metadata Service that I've been talking about on an off, and also verified it works with bluesky: cimd-service.fly.dev I did have to change my application_type to native to use localhost redirect URIs, which was annoying. #oauth #atproto

https://cimd-service.fly.dev/

I wouldn’t say this is 100% accurate but enjoy it for what it is.. a nerdy concept explained with meme cats. 🐱

#Caturday #oauth

I wouldn’t say this is 100% accurate but enjoy it for what it is.. a nerdy concept explained with meme cats. 🐱

#Caturday #oauth

I wouldn’t say this is 100% accurate but enjoy it for what it is.. a nerdy concept explained with meme cats. 🐱

#Caturday #oauth

I wouldn’t say this is 100% accurate but enjoy it for what it is.. a nerdy concept explained with meme cats. 🐱

#Caturday #oauth

Just had a moment of realization: even if the code compiles, it doesn't mean there aren't hallucinations lurking within.

My gen-ai agent added a URL parameter that doesn’t even exist in the OAuth spec.

Everything seemed correct, but it turned out to be just a mock.

#Coding #AI #OAuth

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

#Hollo 0.6.0 is coming soon!

We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:

Enhanced #OAuth #security

• RFC 8414 (OAuth metadata discovery)
• RFC 7636 (#PKCE support)
• Improved authorization flows following RFC 9700 best practices

New features

• Extended character limit (4K → 10K)
• Code syntax highlighting
• Customizable profile themes
• EXIF metadata stripping for privacy

Important notes for update

• Node.js 24+ required
• Updated environment variables for asset storage
• Stronger SECRET_KEY requirements (44+ chars)

Special thanks to @thisismissem for the extensive OAuth improvements that help keep the #fediverse secure and compatible! 🙏

Full changelog and upgrade guide coming with the release.

#ActivityPub

Spent the past hour doing some updates to the Client ID Metadata Documents internet draft. Trying to find alignment with the Client ID Prefix internet draft and fix a few open issues. #ietf #oauth

Spent the past hour doing some updates to the Client ID Metadata Documents internet draft. Trying to find alignment with the Client ID Prefix internet draft and fix a few open issues. #ietf #oauth

Mixing up Public and Private Keys in OpenID Connect deployments - Hanno's Blog:

https://blog.hboeck.de/archives/909-Mixing-up-Public-and-Private-Keys-in-OpenID-Connect-deployments.html

#oauth #openid #security

I don't want to create a new account for every software / server. Where is the #OAuth thing for #ActivityPub?

#Mastodon #PixelFed #Lemmy

Vulnerability in Google’s OAuth System exposes millions to risk

Researchers warn that unused domains could grant unauthorised access to sensitive SaaS accounts

https://www.computing.co.uk/news/2025/security/vulnerability-in-google-oauth-system-exposes-millions-to-risk

#google #oauth #infosec #cybersecurity

OAuth 2.0の認可エンドポイントにおける脆弱な実装例と対策について考える
https://qiita.com/task4233/items/3af1b3d2690b44979659?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #OAuth #OAuth2_0

【Go言語】Goで学ぶOAuth認証
https://qiita.com/fujifuji1414/items/98af4c0529430f112209?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Go #OAuth #認証 #OAuth2_0 #初学者向け

Amplify Gen2 (Vue) で画像管理機能のベースを作る
https://qiita.com/onoshima/items/7431ee1961d71b4d5c9d?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #AWS #OAuth #Vue_js #SRE #amplify

Has anyone made a good, reliable "log in with your fediverse account" library/service, ideally for node.js, yet?

#fediverse #oauth #nodejs #opensource

We got a blog post out summarizing our launch of OAuth for AT Protocol, and what work remains. This has been a huge project, led by Matthieu, with input from a bunch of standards folks and devs.

This tries to solve the same basic challenge that ActivityPub has, and builds on work by @thisismissem and @aaronpk at the IETF (OAuth client metadata documents). Would be great if social web protocols end up aligning on the general shape of a solution and care share code+review.

#oauth #ietf

Gosh this PKCE stuff goes back to 2020.

Reads:
- Dropbox: https://dropbox.tech/developers/pkce--what-and-why-
- Postman: https://blog.postman.com/pkce-oauth-how-to/
- Mastodon OAuth PKCE extension PR: https://github.com/mastodon/mastodon/pull/31129
- Mastodon OAuth documentation PR: https://github.com/mastodon/documentation/pull/1445

#OAuth

Are there any known issues with Friendica's OAuth login flow? Or maybe recent breaking changes?

Suddenly getting an "Unprocessable Entity" error without having made any relevant updates to the code.

#friendica #FriendicaDev #FediDev #oauth

Welcome to my new followers. I have taken possession of your souls, for which I am eternally grateful.

By way of #introduction, here are a few things that I am sometimes known for:

• I wrote the book API Security in Action published by Manning. It covers a lot about modern application security, JWTs, OAuth, Kubernetes, and is secretly a tutorial on cryptography in disguise.

• I discovered the “Psychic Signatures” critical vulnerability in Java’s implementation of ECDSA signature verification (CVE-2022-21449).

• My blog has made its way onto Hacker News a few times.

• I’m fairly active in the #OAuth working group at the IETF. I used to be the Security Architect for ForgeRock (now part of Ping Identity).

In my past I have mostly been a software engineer. I also have a PhD in computer science, for what it’s worth, but only my bank calls me Dr and my daughter thinks I’m lying about that.

These days I run a company, Illuminated Security, that provides AppSec and Applied Cryptography consultancy, review, bespoke development, and training. I’m always happy to answer emails (eventually!) on most topics.