Aaron Parecki

> When you add an MCP server to your Claude organization, you just add the MCP server. Each user will have to go through the integration's OAuth2 authorization flow separately. Check out https://aaronparecki.com/2025/05/12/27/enterprise-ready-mcp - there are some great ideas there on how this can be simplified even more in the future.

For browserless, I was referring to a 2019 article that I could have sworn was newer than that, on the need for OAuth 2.1 that also covers how they added OAuth for Native Apps (Code Flow) and basically a QR code version for TVs: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1 As for SFAuthenticationSession, again my info might be outdated, but the basic idea is that there are often native APIs that can load OAuth requests in a way that doesn’t require you to relogin. Honestly most of those use cases have been deprecated by PassKeys at an operating system level. There’s (almost) no need for a special browser with cookies to your favourite authenticated services if you have PassKeys to make logging in more painless.

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-openid-connec… Free ressources check: -https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m.youtube.com/watch?v=996OiexHze0 https://speakerdeck.com/nbarbettini/oauth-and-openid-connect-in-plain-… -OAuth/OpenID by Nat Sakimura(chairman openid foundation) https://m.youtube.com/playlist?list=PLRUD_uiAYejRvQWkS2xjgFW20lRLp4snN For the active directory topic I don't know good ressources

This did indeed work for Google (that's the only one I tried), but the details of how this works is best detailed in this post: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web The above post was also linked from the obligator project's GH readme

You say this, but plenty of people post short `Status` type posts on their blog just fine. See https://aaronparecki.com/notes for an example. Combination of on-site stuff, mirrors of Twitter and Mastodon content. He's one of many folks posting both short-form statuses and long-form content. It works. If the EU has its way then interoperability with ActivityPub will make migrating followers/following easy, as it is with redirecting Mastodon accounts. Tumblr is adding ActivityPub support. Flickr is mulling it.

As an example https://aaronparecki.com/ does it, but when it comes to documentation entry page https://activitypub.rocks/ and otherwise https://www.w3.org/TR/activitypub/

The IndieWeb ecosystem is already doing this with microformats2 + webmention to support decentralized replies, likes, reposts, etc. with HTML blogs. See https://aaronparecki.com for an example and https://indieweb.org/friendly and https://indieweb.org/Webmention

Are there any good books/comprehensive resources for a beginner wanting to experiment with the irc protocol? I tried setting up my own irc server on an aws instance once. Opening the firewalls, connecting it to other clouds and to the clients was hard [for me]. Would love a step by step guide, that gives quick win and further confidence to get started. This was my original inspiration: https://aaronparecki.com/2015/08/29/8/why-i-live-in-irc

Don't trust google on metadata recommendations, they change it way too often: https://aaronparecki.com/2016/12/17/8/owning-my-reviews

I don't actually believe JWT is useful for that, and indeed recommend something simpler like OAUTH2 (OpenID Connect) simply because it actually handles this use-case, and because it doesn't require any cryptography or anything complicated for a (junior) developer to consume correctly. EDIT: I just saw your spreadsheet. Perhaps you have gotten a bad impression of OAUTH2 by looking at some client libraries. Many of these are made complicated by trying to handle all aspects of OUATH2 instead of the single-sign-on flow, which is simple enough you shouldn't even need a library[1]. [1]: https://aaronparecki.com/oauth-2-simplified/

Some of my favorites... * Tantek Çelik -> http://tantek.com and https://indieweb.org * Aaron Parecki -> https://aaronparecki.com and https://indieweb.org * Patrick (patio11) McKenzie -> http://www.kalzumeus.com * Moxie Marlinspike -> https://moxie.org * Scott Hanselman -> http://www.hanselman.com * Joel Spolsky -> https://www.joelonsoftware.com * Jeff Atwood -> https://blog.codinghorror.com * Gina Trapani -> http://ginatrapani.org * Matthew Hodgson -> http://matrix.org and https://riot.im * Armin Ronacher -> http://lucumr.pocoo.org * Jeffrey Zeldman -> http://www.zeldman.com * Eric Meyer -> http://meyerweb.com

Love that it uses OpenID for the login! If you are/were using MyOpenID, you can switch your delegation to IndieAuth since they are shutting down. It's an easy switch: http://aaronparecki.com/articles/2013/09/15/1/indieauth-now-supports-o…

This is fantastic. I've implemented OAuth2 4-5 times over the past few years. It seams overly complicated at first, but over time I've come to understand more of the vulnerabilities each piece of complexity exists to mitigate. Every time I've thought I could do it simpler, I eventually discovered a vulnerability in my approach. You get basically all that knowledge here in a concise blog post. This is going to be the first thing I link anyone to if they're interested in learning OAuth. One gripe from Attack #3[0]: > The solution is to require Pied Piper to register all possible redirect URIs first. Then, Hooli should refuse to redirect to any other domain. There's actually a another (better IMO) solution to this problem, though to date it's rarely used. Instead of requiring client registration, you can simply let clients provide their own client_id, with the caveat that it has to be a URI, and a strict prefix of the redirect_uri. Then you can show it to the user so they know exactly where the token is being sent, but you also cut out a huge chunk of complexity from your system. I learned about it here[1]. [0]: https://stack-auth.com/blog/oauth-from-first-principles#attack-3 [1]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at it from a secure protocol design perspective it is riddled with accidental complexity producing unnecessary footguns. The main culprit is the idea to transfer security critical data over URLs. IIUC this was done to reduce state on the involved servers, but that advantage has completely vanished, if you follow today's best practices to use the PKCE, state and nonce parameter (together with the authorization code flow). And more than half of the attacks you need to prevent or mitigate with the modern extensions to the original OAuth concepts are possible because grabbing data from URLs is so easy: An attacker can trick you to use a malicious redirect URL? Lock down the possible redirects with an explicitly managed URL allow-list. URLs can be cached and later accessed by malicious parties? Don't transmit the main secret (bearer token) via URL parameters, but instead transmit an authorization code which you can exchange (exactly) once for the real bearer token. A malicious app can register your URL schema in your smartphone OS? Add PKCE via server-side state to…

Yeah, I read this and thought "makes total sense that Okta would be one of the prime movers behind this". The more I think about it, the more this is just like an app dashboard that an employee can use to access many different apps and that the enterprise can use to control and monitor access. So it makes total sense that they solved this (very real) problem. I like one of the author's characterizations[0]. > Now employees no longer have to connect MCP servers manually and wait for a series of OAuth and login prompts. Once you log in to Claude from Okta, all the preconfigured MCP servers are already connected! It's not every day you get to improve both usability and security! 0: https://aaronparecki.com/2026/06/18/12/claude

Totally. Still getting my head around this write up but it goes into a lot of detail. https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protoco…

A nice, comprehensive yet accessible blog post about it can be found here[1], got submitted earlier[2] but didn't gain traction. [1]: https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protoco… [2]: https://news.ycombinator.com/item?id=43620496

Question about this indie auth thing, or anonymous clients, mentioned at the linked page. Wouldn't that effectively grant access to your user data to everyone, regardless of their intentions? Meta, for instance, has very strict TOS and privacy policy checks before approving a client_id. And those checks are on-going. https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

Has support for IndieAuth and/or FedCM (when stable enough) been considered? https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web https://github.com/fedidcg/FedCM

I just read Aaron Parecki's "How to leave Facebook" post yesterday and I think his way is much better. If you want to quit facebook don't forget to check it here first: https://aaronparecki.com/2020/06/14/14/how-to-leave-facebook

It still amazes me that people have managed to create a viable system of decentralized comments across independent, statically-generated websites. Perhaps I should heed the (humorous) warning by Ben Werdmuller here, though: https://aaronparecki.com/2013/05/21/4/xkcd#mentions

I'll shoot you an email, and we can talk more if you do end up working on this. I'm not a big fan of pre-registered clients in the first place. Ideally any client should be able to talk to any OAuth2 server that speaks the same profile, ie endpoints and scopes. Aaron Parecki describes a way to allow "anonymous" clients here[0]. As I understand that's how IndieAuth is implemented. But I'm still relatively new to OAuth, and I don't doubt there could be subtle security issues. Do you have any thoughts on that? [0]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

There is IndieAuth, which adapts OAuth 2 to work with URLs as identities (and being OAuth, can even do authorization): https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web https://indieauth.net/

Thanks for sharing my site! As you say, I'm quite big with IndieWeb, and for readers there are quite a few other folks you'll want to see - https://snarfed.org/ https://tantek.com/ https://aaronparecki.com/ and https://www.barryfrost.com/ to name just a few. If anyone is interested learning more about the IndieWeb, https://www.jvt.me/posts/2019/10/20/indieweb-talk/ is a transcript of a conference talk I gave on what the IndieWeb is

You can run weechat on server and connect via ssh (https://aaronparecki.com/2015/08/29/8/why-i-live-in-irc describes this setup)

I think https://aaronparecki.com/oauth-2-simplified/ explains that the cryptographic signature approach (if that's what they mean by "client secret") was discarded because mobile apps and single-page Javascript apps can't maintain the confidentiality of a secret anyway. So maybe OAuth 1.0 is only better for apps running on a server?

There's a standard for that called Webmention, but it's not widely used : https://indieweb.org/Webmention You can see it in action on this page : https://aaronparecki.com/oauth-2-simplified/

I may be biased, but I'd second the nominations for Portland, Oregon. A lot of interesting things are happening. Acquisitions and funding have been intense. Check out the list: http://aaronparecki.com/Portland_Funding_and_Acquisitions

> Most people understand these two things to be, collectively, the "provider" side of OAuth Citation needed. As another commenter already noted, the term "Provider" is rarely used in OAuth itself. When it is mentioned, it's typically in the context of OpenID Connect, where it refers specifically to the Authorization Server - not the Resource Server. > the service provider, who is providing an API that requires authorization That’s actually the Resource Server. I understand that the current MCP spec [1] merges the Authorization Server and Resource Server roles, similar to what your library does. However, there are strong reasons to keep these roles separate [2]. In fact, the MCP spec authors acknowledge this [3], and the latest draft [4] makes implementing an Authorization Server optional for MCP services. That’s why I’m being particular about clearly naming the roles your library supports in the OAuth flow. Going forward, MCP servers will always act as OAuth Resource Servers, but will only optionally act as Authorization Servers. Your library should make that distinction explicit. [1]: https://modelcontextprotocol.io/specification/2025-03-26/basic/authori… [2]: https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protoco… [3]: https://github.com/modelcontextprotocol/modelcontextprotocol/issues/20… [4]: https://modelcontextprotocol.io/specification/draft/basic/authorizatio…

RSS is pull only. It probably serves 80% of needs for most people ("I want to know when so-and-so has new content without manually going to the site") but ActivityPub does a bit more: - pushes content to subscribers in real-time (doable with RSS with WebSub https://en.wikipedia.org/wiki/WebSub) - allows content to "swim back" to the publisher: comments, replies, retweets/boost (doable with WebMentions https://www.w3.org/TR/2017/REC-webmention-20170112/) - defines a protocol for posting to an AP-enabled endpoint (doable with micropub) AP defines a lot of things but doesn't do it well (see https://schub.wtf/blog/2019/01/13/activitypub-final-thoughts-one-year-… because it is not strict enough in what constitutes valid content. There are alternatives, listed above, that already do the work but they are centered towards everyone having their own server and going from site to site to post comments; the real appeal of AP solutions is that they're an all-in-one blob you connect to, and from which you do your browsing. The indieweb people (responsible for the alternatives above) have come up with "social readers" to enable this and have made a few propositions already: see https://indieweb.org/social_reader (https://aaronparecki.com/2018/03/12/17/building-an-indieweb-reader in particular)