5 ms·
Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
by stormking 10mo ago
Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
- stgraber 10mo agoYeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra. TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.