Just to throw this out there, IndieAuth is a very small addition to OAuth 2.0 which adds identity into the system in a much lighter weight way than OpenID Connect. Mastodon could easily add this extension to return the user ID of the user who just authenticated. The login form on OwnCast would ask the user to enter their server name, and do discovery on the server to send the user there to log in.
I did a talk about how Mastodon/ActivityPub apps can use IndieAuth to accomplish this kind of thing. The video is available -- of course -- on my website: https://aaronparecki.com/2020/09/22/25/activitypub-oauth-2-1
@aaronpk Ah right! Thanks for the quick reply. Makes sense with regards to community management, wanted to just understand the possible underlying technicalities that carry those bits and get a head start.
As much as I read/consume specs, I am unfamiliar with the IETF process in general. I'll try to find a way to stay +cc'd on any related discussions, if they're held in the open.
@aaronpk Hey Aaron, following up from the #apconf2020 talk you gave, I think you briefly mentioned a concept of "dynamic scopes" or something similar. Where can I find the latest information around that?
Context: Working on `apcore` framework for building federated apps in golang, have long wanted to include OAuth2 as a foundational inclusion for the framework (and apps built with it). I'm having to fork another library anyway to add support for PKCE, might as well look at dynamic scopes too.