<div dir="ltr">FWIW i tried to address this by building a .NET library on core 1.1 for relying parties. The big problem for me was the certification as the existing .NET tooling did not support dynamic registration. When i tried to load that solution library into the MSFT samples, they had changed to .net core 2.0 and were not interested in a core 1.1 implementation. Now they are on to .net core 3.0. Identity mgmt is in a state of flux and the w3c ccg is not helping to stabilize the situation at all. While its hard to know how the openID foundation can help, i would recommend considering a certification test suite that did not depend on dynamic registration.<div><br></div><div>In the meantime, i am trying to build a openid self issued ID open source solution compatible with the w3c ccg, to see if that can bring the two together.<br><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peace ..tom</div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 29, 2019 at 12:18 PM Mike Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_184258110026402069WordSection1">
<p class="MsoNormal"><span style="color:rgb(0,32,96)">For what it’s worth, I thought the article
<a href="https://developer.okta.com/blog/2019/01/23/nobody-cares-about-oauth-or-openid-connect" target="_blank">
https://developer.okta.com/blog/2019/01/23/nobody-cares-about-oauth-or-openid-connect</a> was mostly positive for OAuth and OpenID Connect (once you get past the title). Remember that unlike OpenID 2.0, we haven’t tried to make “OpenID Connect” a consumer
brand. In fact, when we present about OpenID Connect, we typically remind people that they’re probably using OpenID Connect, even though they may not know it. For instance, Slide 4 of
<a href="http://self-issued.info/presentations/OpenID_Connect_Introduction_23-Oct-18.pdf" target="_blank">
http://self-issued.info/presentations/OpenID_Connect_Introduction_23-Oct-18.pdf</a> says:<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:0.5in"><b><span style="color:rgb(0,32,96)">You’re probably already using OpenID Connect!<u></u><u></u></span></b></p>
<ul style="margin-top:0in" type="disc">
<li class="gmail-m_184258110026402069MsoListParagraph" style="color:rgb(0,32,96)">If you have an Android phone or log in at AOL, Deutsche Telekom, Google, Microsoft, NEC, NTT, Salesforce, Softbank, Symantec, Verizon, or Yahoo! Japan, you’re already using OpenID Connect<u></u><u></u></li><li class="gmail-m_184258110026402069MsoListParagraph" style="color:rgb(0,32,96)">Many other sites and apps large and small also use OpenID Connect<u></u><u></u></li></ul>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">I thought that this part of the article was dead-on:<u></u><u></u></span></p>
<p style="margin-right:0in;margin-left:0.5in;margin-bottom:0.0001pt">
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)">The reason nobody cares about OAuth and OIDC is that OAuth and OIDC aren’t what developers are interested in. The only thing developers are
<em><span style="font-family:"\000026quot",serif">actually</span></em> interested in is what OAuth and OIDC help with,
<strong><span style="font-family:"\000026quot",serif">authentication and authorization</span></strong>.<u></u><u></u></span></p>
<p style="margin-right:0in;margin-left:0.5in;margin-bottom:0.0001pt">
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)"><u></u> <u></u></span></p>
<p>
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)">99.99% of developers out there don’t know (or want to know) anything about OAuth, OIDC, or any other security specifications. All they want to do is find the simplest and most straightforward
way to support user authentication and authorization in their application. They don’t care about standards, specifications, grant types, JWTs, or scopes and timeouts – all they want to do is log a user in and check to see what permissions they have.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">To be clear, Okta advertised their allegiance to OpenID Connect here (and in their
<a href="https://openid.net/certification/#OPs" target="_blank">OpenID Certifications</a>):<u></u><u></u></span></p>
<p style="margin-right:0in;margin-left:0.5in;margin-bottom:0.0001pt">
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)">With the state of tooling right now, web developers are essentially
<em><span style="font-family:"\000026quot",serif">forced</span></em> to learn about OAuth and OIDC and are burdened with the need to understand how these standards work and how to (hopefully) apply them properly to their application. It isn’t a great system.<u></u><u></u></span></p>
<p style="margin-right:0in;margin-left:0.5in;margin-bottom:0.0001pt">
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)"><u></u> <u></u></span></p>
<p>
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)">This is one of the reasons why, here at
<a href="https://developer.okta.com/" target="_blank"><span style="color:rgb(0,125,193)">Okta</span></a>, even though our entire platform is built on top of OAuth and OIDC, we spend tons of time and effort trying to build abstractions (in the form of client libraries) to hide those
complexities and make securing your web applications simpler.<u></u><u></u></span></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">I also agree with the gist of this conclusion:<u></u><u></u></span></p>
<p style="margin-right:0in;margin-left:0.5in;margin-bottom:0.0001pt">
<span style="font-size:12pt;font-family:"\000026quot",serif;color:rgb(93,93,93)">While OAuth and OIDC are certainly useful and important, the reality of the situation today is that almost nobody cares about OAuth and OIDC. Developers don’t want more OAuth and OIDC libraries
and documentation in their lives: they want less of it.<u></u><u></u></span></p>
<p class="MsoNormal">
<span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)">The easier that we can all make it for developers to securely use OpenID Connect, the better everyone. That’s always been the goal!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Nat Sakimura via Openid-specs-ab<br>
<b>Sent:</b> Monday, January 28, 2019 3:43 PM<br>
<b>To:</b> Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>>; Mike Schwartz <<a href="mailto:mike@gluu.org" target="_blank">mike@gluu.org</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Marketing OpenID: combatting negativity<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Mike, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">+1 on running inter-linked blog and vlog posts. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">+1 also for positioning OpenID is fun and easy. The "easy" part is a bit an overstatement but it is clinically proven that if people were told that it is hard, they will absolutely stop learning. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Nat<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Sun, Jan 27, 2019 at 9:02 PM Mike Schwartz via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><br>
I think to go head-to-head with the negative OpenID press, we need to <br>
market a message something to the effect of:<br>
<br>
"Using OpenID is great fun, and it solves real problems for developers."<br>
<br>
You can't combat negativivity with a message of: "the detractors have a <br>
point".<br>
<br>
We have the brain trust in this community to get that message out. If <br>
everyone wrote one blog, and we all cross-promote on social media (i.e. <br>
more of what Nat is doing so brilliantly on Youtube...), I think we <br>
could make a dent in perceptions. Especially if we tap into the <br>
corporate marketing cabailities of our respective organizations.<br>
<br>
- Mike<br>
<br>
<br>
-----------<br>
Michael Schwartz<br>
Gluu<br>
Founder / CEO<br>
<a href="mailto:mike@gluu.org" target="_blank">mike@gluu.org</a><br>
<a href="https://www.linkedin.com/in/nynymike/" target="_blank">https://www.linkedin.com/in/nynymike/</a><br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>