6

MSAL, Microsoft's absolute dumpster fire of an authentication library. Who in their right mind designed this overcomplicated mess? The documentation reads like it was written by a committee of drunk orangutans throwing darts at a keyboard.
Want to do a simple login? HAHAHA GOOD LUCK! Here's 47 different configuration options you need to set up, three different flow types that are basically the same thing with slightly different names, and error messages that might as well be written in hieroglyphics. "AADSTS700054" yeah that's SUPER helpful, thanks Microsoft!
And don't even get me started on token caching. Oh, you thought your tokens would just... work? NOPE! Hope you enjoy debugging why your perfectly valid token is being treated like a expired coupon at a grocery store. The refresh token flow is about as reliable as a chocolate teapot.

I worked on a great project that was later axed and part of that was because of Msal issues. We literally only dealt with Msal issues. The app was otherwise stable. There were always issues with SSO, login, token validation...
It just couldn't work, like, at all.
I could see the clients getting fed up of the constant issues, yet, they couldn't move away from Microsoft since they'd already invested into their entreprise ecosystem. AzureAD, Office 365, you name it.

Shit like this is why I laugh whenever someone suggests that AGI will take over the world. Like, bro, we still haven't figured out how to make an auth library that actually works, and you think we're close to making a machine capable of thinking like a human?
Yeah right!

Comments
  • 1
    Nah, if agi thinks like a human is based on some test with several points. Who says the test is good enough. We don't know. I can imagine that the test needs some revisions too.

    We're so crazy with security and tokens in general. It's crazy shit. Secure the network and let the services on it have free access to eachother. Done.
  • 1
    "committee of drunk orangutans throwing darts at a keyboard."

    That is a bold thing to call DEI hires.
  • 1
    Of course MS needs to invent their own auth crap… why am I even surprised?
  • 0
    Spring webflux security is a bird of the same feather. I created a question about it on stackoverflow. My question and the answer both got downvoted cuz (according to the downvoters), token based authentication is discouraged. Meanwhile, this is not mentioned anywhere

    One of them posts a link to the recommended implementation, and it's just a roadmap/spec document on a github thread https://github.com/spring-projects/.... It's like a prank. A bunch of the guys there thank each other, but there is no mention of any api or implementation detail /sample of spring webflux security on there
  • 0
    Do you have to use MSAL even if the Idp is Azure AD / Entra?
Add Comment