alt Hacker NewsI already said that using a library (open source) is a good idea, I just don't think we need to pretend that Auth is so complicated that we need a third-party provider. I don't buy that argument. You should not roll your own low-level code, you should never need to even look at the RFC's, just hook into the Auth library you use (library, not service).
> just hook into the Auth library you use (library, not service).
I think this is a fundamental misunderstanding of how this stuff works. You can't "just use a library". Your identity server is a service, open source or not and you have to align to how they do things.