doorkeeper-gem/doorkeeper-openid_connect

[meta] Looking for maintainers!

toupeira opened this issue · 12 comments

toupeira commented

I'm increasingly neglecting this gem because I'm not really using it in any of my current projects, and working with OAuth / OIDC is just generally causing me a lot of headaches 😛

If anybody wants to become a maintainer, please let me know!

/cc @nashby @nbulaj

giubueno commented

Ping me.

  • 👍1
nbulaj commented

@toupeira I will provide a support for this gem (as doorkeeper maintainer), like some bugfixes and improvements, but not new features. Could you please check if I have permissions to push to rubygems? I have something more to merge soon, and we need to release a new version with a fixes to support latest Doorkeeper (5.4).

  • 👍1
toupeira commented

@nbulaj thanks! 👍

And yes you should have permission:

$ gem owner doorkeeper-openid_connect
Owners for gem: doorkeeper-openid_connect
- nikita_bulai
- ops@playonsports.com
- markus-koller@gmx.ch
  • ❤️1
mecampbellsoup commented

and working with OAuth / OIDC is just generally causing me a lot of headaches 😛

Out of curiosity (as we embark on a buy-vs-build decision at our company) could you elaborate on these headaches?!

  • 👍1
toupeira commented

@mecampbellsoup well, just take a look at the length and complexity of these specs 😁

But joking aside, I originally started extending this gem so we could support OIDC in GitLab, so it's used quite widely (especially at Siemens, who originally sponsored that contribution), and @nbulaj and me are still around now and then to look after bugfixes and other small improvements.

And really most of the heavy lifting is done in the main Doorkeeper gem, so if you're tied to Rails I don't think there's a good reason to start from scratch 🙂 You might be interested in https://github.com/nov/openid_connect though, if you're looking for more of a library rather than a Railsy framework solution.

mecampbellsoup commented

@mecampbellsoup well, just take a look at the length and complexity of these specs 😁

But joking aside, I originally started extending this gem so we could support OIDC in GitLab, so it's used quite widely (especially at Siemens, who originally sponsored that contribution), and @nbulaj and me are still around now and then to look after bugfixes and other small improvements.

And really most of the heavy lifting is done in the main Doorkeeper gem, so if you're tied to Rails I don't think there's a good reason to start from scratch 🙂 You might be interested in nov/openid_connect though, if you're looking for more of a library rather than a Railsy framework solution.

To be sure, we would use this library if we went with Ruby. However we are more likely to use Python due to ... well, other concerns not related to this conversation.

I was more curious whether you were suggesting that:

  • you are a "buy" proponent in the build-vs-buy debate (e.g. Auth0, Okta); or
  • you are opposed to OIDC whatsoever (on the IdP side, i.e. should my company's auth server be a full-fledged OIDC IdP, or is it sufficient to simply issue opaque tokens and do session management like the good old days)
toupeira commented

@mecampbellsoup I'm not opposed to OIDC at all, it seems perfectly fine if you want to build your own SSO, and OAuth2 will probably crop up anyway if you want to integrate with other services.

Regarding hosted SSOs, I don't have much experience with them and zero knowledge about your business so I can't really give you any advice 😉 But I do know that Auth0 and Okta also offer OIDC and are certified providers: https://openid.net/certification/

stanhu commented

@toupeira Do you think you could add me here?

toupeira commented

@stanhu oh hey, sorry for the delay! Turns out the notifications for this repository were still getting sent to my old gitlab.com address 😅

I haven't been active here in a while, so I'll leave this decision to @nbulaj who's taken over the helm. For context, Stan works at GitLab and I trust him fully, and I myself have left GitLab earlier this year 🙂

nbulaj commented

Oh, @stanhu do you still interested in helping maintaining the gem? Just let me know please 🙏 Sorry didn't have enough time to read all the discussions.

pboling commented

It's interesting that the readme points to the official list of certified client/server libraries for OpenID Connect, which only has one Ruby library listed, (https://gitlab.com/os85/rodauth-oauth). Was this library previously certified? Or is the link there to subtly hint that people ought to look into using a different library?

toupeira commented

@pboling oh, that link points to http://openid.net/developers/libraries/ which now redirects to https://openid.net/developers/certified-openid-connect-implementations/. At the time I added it it was just a collection of libraries and clients, and IIRC this gem was on there too 😉

The gem was never certified though, back then it was only possible to certify specific deployments but I see they now also list "Certified OpenID Provider Libraries". We tried to get the gitlab.com deployment certified, but that didn't go anywhere due to lack of interest: https://gitlab.com/gitlab-org/gitlab/-/issues/414305

I did use https://gitlab.com/openid/conformance-suite to check conformity and iron out bugs, so if anybody wants to take this topic up again it should be mostly there on the technical side. 🤞

  • 👍1