Did OAuth fail?

Question

I find it appropriate to use OAuth for single sign-on (SSO) with RESTful services. At first glance, using OAuth as a de facto standard looked natural to me. But I must confess that I do not understand how to use it for single sign-on. As I studied OAuth, I found more and more criticism of authorization - so much so that I am inclined to believe that OAuth failed.

OAuth is hard to implement.

Usability is bad.

Why Facebook Doesn't Implement OAuth Today:

• "OAuth is more complex and less productive than our own authentication mechanism."
• "OAuth WRAP seems to solve most or all of these problems."
• Poor performance due to many requests and long URIs
• "The overall quality of the library is pretty poor."

Perhaps WRAP from Microsoft, Yahoo and Google will replace OAuth.

What happens with OAuth (and WRAP)?

So didn't OAuth work? What are the alternatives to SSO - preferably those that are widely recognized or promising for widespread use? Would you prefer WRAP ?

Answer 1

OAuth is not an SSO solution, it is a protocol commonly used to delegate API authorization. 3 legged OAuth allows a client requesting access to a secure resource to delegate authority to the server hosting the resource. In principle, the user does not need to provide his credentials to a third party (client) only on the server that hosts the protected resource. OpenID might be a better solution if you want to implement single sign-on. You can also use the OpenID OAuth extension, which allows you to combine authentication with authorization through OAuth.

OAuth 2.0 is currently being worked on. WRAP was designed as a gap management solution to address some use cases not covered by the original OAuth 1.0a specification. WRAP will not replace OAuth; rather, WRAP ideas will come their way in OAuth 2.0, where necessary. Several original OAuth authors wrote about this here, as well as one of the authors of WRAP:

What is happening with OAuth?

So, no, OAuth did not fail; in fact, it enjoyed a fairly wide adoption. OAuth 1.0 will continue to be implemented by a large number of providers, and OAuth 2.0 will eventually be available. WRAP exists for people who want to take advantage of the benefits that it uses now.

Regarding the complexity of implementing OAuth as a client, why not try it? Available libraries are of high quality, but with a decent one you can usually implement an OAuth client throughout the day.