Sponsor Link

[ahussey-redhat]

It looks like the sponsorship link isn't working, and isn't available on each repo.

User statement:
As a possible end user of passworless.id to determine if I want to use this as part of my application I want to check if the product is actively maintained, and use the sponsorship area to see if there's support from other organizations and individuals.

I love the idea of a public IDP and would like to support this project.

sidenote: have you gathered support from any organizations? I understand this is in alpha, but just wanted to gauge external interest

[dagnelies]

Hi. This project is currently in its infancy, and there is no financial backing yet. Actually, as you noticed, the sponsoring link does not even work. I have some paperwork to do there regarding taxes and so on. I currently neglected it in favor of actually completing the service since a few key pieces like multi-device and account recovery are still missing. I'm also a developer at heart, rather than someone running after funding. Nevertheless, I understand the need for it for the thrust impact and long term sustainability of the project. That's why I plan to reach out to Cloudflare for example, since they play a key role in the infrastructure. I have another company in mind too. But this is currently all on the TODO list. So you'd be the first backer 😉Of course, having RedHat as official sponsor would be great too. Just give me some time until the ground work is done regarding paperwork & co.

[ahussey-redhat]

@dagnelies , that makes perfect sense :)
I 100% agree. The focus should be on productionizing the MVP, so that it includes the features you mentioned (multi-device and account recovery).

I'm definitely not speaking on behalf of Red Hat 😛 but have a personal interest in this project, and am also raising awareness about this project to some of the internal teams, to see if its something they might want to use and/or support.

At a minimum, I'd be happy to contribute where possible. Whether it be documentation, or code. Possibly financially as well.

Great work with what you are doing! And I really hope it takes off

[ahussey-redhat]

Someone pointed me to this; https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.6/html-single/server_administration_guide/index#creating_a_password_less_browser_login_flow

Upstream; https://www.keycloak.org/docs/latest/server_admin/#creating-a-password-less-browser-login-flow

[ahussey-redhat]

Not sure if you already incorporate Keycloak in your flows, but it might be useful. You can still be the public identity provider and be federated with from other SSO/Keycloak instances.

You could definitely still provide webauthn flow too!

[dagnelies]

Thanks for the encouraging words.

Not sure if you already incorporate Keycloak in your flows, but it might be useful. You can still be the public identity provider and be federated with from other SSO/Keycloak instances.

I'm not very familiar with Keycloak, I just saw it once briefly some time ago. I'm not sure either if you mean using KeyCloak as the foundation, or using Passwordless.ID as an authentication provider for KeyCloak.

If it's the fromer, I didn't use Keycloak as backend service for several reasons. The main one is that I wanted a lightweight service that could run in a so-called "serverless" infrastructure where the code runs on-demand at the "edge" (https://workers.cloudflare.com/). The benefits would be manyfold: lower latency, better scalability, no server maintencance, etc. For that, keycloak was simply not suited.

If it's the latter, Passwordless.ID can actually be registered as a generic OpenID provider. For the implicit flow at least. The auth code flow might come in the future too. But there is a small piece missing here too: the JWKS endpoint (delivering the public keys to verify signatures). It's also on the TODO list.

At a minimum, I'd be happy to contribute where possible. Whether it be documentation, or code. Possibly financially as well.

Thank you. Any kind of help or assistance is welcome. Showing interest and spreading the word is already pretty nice.
Currently, what I'm missing the most is indeed feedback and developers trying to actually use it.
For example, I don't even know if everything works properly with iPhones / MacOS since I have no apple devices.
Likewise, I have no idea either if the documentation and examples are clear enough for developers to make use it or if some pieces are missing. Since I'm "inside the bubble", I might not be aware of some obvious things users or developers might need.

I think once developers start to use it, it means their users will use it, which will attract more developers, and so on.
It's something everyone benefits from. Getting the ball rolling is the best, and for that, I want to get rid of the last hurdles in the way.

[dagnelies]

...well, for whatever reason my "passwordless-id" sponsorship account is stuck in a "pending" state ...like, for weeks. Dunno why.

...and there is no obvious way to contact them about it ...quite strange.

For now, I put my personal account, which was approved in a single day... But I find it suboptimal. I'd rather set it up as organization rather than a personal project ...although it is indeed a personal project at the moment.

[dagnelies]

At long last it's approved, yay!