Title: OAuth vs. OpenID – What’s the difference?
1OAuth vs. OpenID whats the difference?
- First of all, saying either OAuth or OpenID is
not specific enough. -
- There are at least three versions of both.
-
- The IETF OAuth standard is OAuth 2.0, and is an
authorization standard. However, you could define
a profile of OAuth 2.0 for anything. -
- OpenID Connect (not OpenID 1 or OpenID 2) is
in fact such a profile of OAuth 2.0 that defines
a workflow for authentication. It is quite close
to Googles authentication API. The great thing
about OpenID Connect is that we had too many
proprietary APIs that did the same thing
authenticated a person. -
- For example, Google and Face book both used OAuth
2.0 differently, as did a plethora of other
websites (see everyauth). OpenID Connect
represents years of work to align consumer IDPs
(i.e. MSFT, Google, Yahoo) and other industry
participants on a single profile of OAuth 2.0 for
authentication. Along the way, OpenID Connect
also defines standards for Discovery (Web
finger),
2Dynamic Client Registration (so you dont have to
ask every website for a client id and password
manually), and session management
(logout). For more information feel free to
visit Gluu.org. Also, the OX platform offers
a free open source implementation of an OpenID
Connect OP (OpenID Provider like a SAML IDP).
There is plenty of client code out there to
utilize an OpenID Connect OP if you cant find a
specific library for OpenID Connect, just use the
OAuth2 client library for your platform, and
start with the Google workflow, and youll have
to make some minor adjustments. Article
resource - http//www.blogster.com/thegluuserver/
oauth-vs-openid-whats-the-difference