#dev 2024-11-25
2024-11-25 UTC
JadedBlueEyes, geoffo, [morganm], srijan, GuestZero and Burke joined the channel
# 
carrvo With rel="authorization_endpoint" deprecated, am I correct that I have two options: RelMeAuth (which is just swapping with rel="me" and a supported backing authenticator) and server metadata endpoint (which I think has to be hand-crafted...)? I am guessing that the "best" answer is to do both...
# carrvo For RelMeAuth, what kind of support does the backing authenticator need? Like, I have https://github.com/Inklings-io/selfauth setup already, how would this work with RelMeAuth?
# carrvo [edit] For RelMeAuth, what kind of support does the backing authenticator need? Like, I have https://github.com/Inklings-io/selfauth setup already, how would this work with RelMeAuth?
# carrvo For server metadata endpoint, am I expecting to hand-craft this? Do I need to have strong technical knowledge of the underlying OAuth standard? If I make this metadata endpoint live up to OAuth/OIDC specs, will it just magically work with OAuth/OIDC clients/libraries?
# carrvo I felt quite happy with setting up my first IndieAuth path (client login -> homepage -> authenticator -> client redirect) until I realized that with other authentication methods future requests also include request header values and my test IndieAuth client only had server-side session variables. I assume that I need a token endpoint, but I expected that to be for authorization that I am not convinced I need.
# carrvo Is the Micropub spec supposed to be used for all IndieAuth clients? Like, I want to build a client where users log in with IndieAuth and then I check their identity URI against an allowlist for different files as a mechanism to share those files with family and friends.
# carrvo With Basic Auth, their identity is in the Authorization header and PHP sees it as $_SERVER['PHP_AUTH_USER']; easy except they need to authenticate against my server (and have an identity created).
# carrvo I apologize if this is a lot at once. I am only just getting back to this personal project.
jimw2, [qubyte], jimw3 and jonnybarnes joined the channel
ancarda, capjamesg, roxwize, srushe, nnrx, eb, rob32, suki, okCiel, vikanezrimaya and athenaeryma joined the channel
# 
[aciccarello] carrvo, micropub is separate from indieauth. But indieauth is often used to authenticate before using micropub to publish.
# [aciccarello] If you only need to check access against an allowlist you should be able to just use indieauth
# [aciccarello] RelMeAuth using the https://indieauth.com/ service can be a rel=me link on a website for the user of your site. Then your protected website would need to either use a service like https://indielogin.com/api or implement the oath stuff to check authentication.
gRegor, sebbu and eitilt joined the channel
# carrvo Thanks. Sounds like I need to look deeper into the OAuth stuff.
lazcorp and [Murray] joined the channel
[benji], lazcorp, [mattl], [snarfed] and [juliaro] joined the channel