When comparing oauth2 providers I find that Google, while being the most compliant has the absolute worst working examples of their code. Everytime I see example code from google I get the mental image picture of a 24 year old developer who claims "its works!" while not even considering how someone who has never used the technology they are proposing may interpret their completely uncommented code base.
Really? So I attempted to get this framework working in my app for hours. It requires that you use the google model objects and the xsrfutil libs to work (I guess I never got it to).
https://developers.google.com/accounts/docs/OAuth2WebServer
and
https://code.google.com/p/google-api-python-client/source/browse/samples/django_sample/plus/views.py
This FLOW framework obscures the oauth2 process from the developer, so you are completely dependent on the code base being simple to understand to get the implementation working. Secondly creating the oauth2 app client credentials are buried deep in google's "API Dashboard". It was the longest amount of time I have ever spent on an oauth2 implementation. I have done many of these and this one is very difficult to work with.
Compare this to oauth2 providers that actually give you the curl approaches directly, and allow you to compare it to their API. Their oauth2 implementation is not hidden, and you can easily figure out what needs to be done.
Paypal
https://developer.paypal.com/docs/api/#authorizations
Pretty good outh2 implementation, well documented, easy to use API. Poor user object returned on successful auth in some cases.
Github
https://developer.github.com/v3/oauth/
Its good. Period.
Coinbase
https://www.coinbase.com/docs/api/authentication
Good implementation and documentation. The python examples were a little off but a python dev can figure it our. Their support responds to problems. Worthy.
Here are my recommendations to oauth providers:
- Make the entire three legged process easy to natively implement via curl commands.
- Build auth apis that are simple extensions of that flow
- Make sure that the client api can access enough user information to create a user record on the target app without asking for more information.
- Make it easy for developer to create client app secrets and manage multiple environments.
