Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user.

Now I read about OpenID Connect and am a little bit confused.

What is the difference between OpenID Connect and using the identity API over OAuth? Is it just that I have a standard profile API, so that I don't have to worry whether I get an "email" or an "emails" JSON back?

Or is there more to it, which makes the OpenID Connect approach more secure than my first approach?

share|improve this question
It's more than an authentication mechanism, OAuth will enable your application to retrieve shared contents and ask for the permission to do so. For example: facebook/gmail apps, you click agree to share your contacts and let the app write on your wall. The app then gets a token that gives it the permission to do so. If you are doing only authentication and will not do more, you could stick to openid. Note that OpenID is not that friendly compared to OAuth. I would use openid for geek/techie things and oauth for social apps. – Aki Jun 21 '13 at 13:30
...I was refering to openID connect which is based on OAuth... – rdmueller Jun 21 '13 at 13:47
Alright, I didn't know about "OpenID Connect", I understood it as "OpenID" + "Connect". I'm sure you've already checked this:… + I suggest you edit your question so that it reads OAuth 2.0 instead of just OAuth. – Aki Jun 21 '13 at 15:04
Just another competing standard. – Vitaly Osipov Jun 22 '13 at 13:05
@Ralf: As I see it, you can build apps with oauth and authorize sharing or not of specific resources linked to the user account. Using openid connect, it is made easier, the provider doesn't have to implement its own layer above oauth to handle it and clients have a standard way to access data. – Aki Jun 26 '13 at 8:06

5 Answers 5

up vote 17 down vote accepted

OpenID connect will give you an access token plus an id token. The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider.

In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance scopes, endpoint discovery, and dynamic registration of clients.

This makes it easier to write code that lets the user choose between multiple identity providers.

share|improve this answer

OAuth provides only and should only provides authorization using an access token. OpenID connect is built on OAuth 2 in order to provide user authentication information. But will not provide you a more robust implementation than OAuth (since it uses OAuth and add some extra interactions with a OpenID provider).

OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 [RFC6749] protocol. It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. OpenID Connect Core 1.0 - draft 17

Things is, OpenID connect provides you a "standard" way to obtains user identity. If you use OAuth and the API, you should adapt your request for each ressources, which may not always provide the same information or may change over the time. And conceptually, you use OAuth to be allowed to use an API, not to authenticate an user.

As background, the OAuth 2.0 Authorization Framework [RFC6749] and OAuth 2.0 Bearer Token Usage [RFC6750] specifications provide a general framework for third-party applications to obtain and use limited access to HTTP resources. They define mechanisms to obtain and use Access Tokens to access resources but do not define standard methods to provide identity information. Notably, without profiling OAuth 2.0, it is incapable of providing information about the authentication of an End-User. OpenID Connect Core 1.0 - draft 17

Note that, OpenID connect provides an id_token with some information about the user. But if you want the whole set of information, you still need the access_token to request the the OpenID provider to get the userinfo (which confuse me the first time I see it). That show that request user information from an API or from the OpenID provider use almost the same method. See 5.3.1. userinfo request in the draft

share|improve this answer

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated.

Technically, OAuth does not have to give you any information about the user. What it provides is a validation that the user has given authority to the application to access some data. This is governed by the scope of the authorisation grant.

OpenID Connect provides a way for the application to retrieve information about the authenticated user. Most importantly it provides a level of assurance that the information is valid (as far as the authorisation server is concerned anyway). This can then be used to facilitate identity federation.

In the past, federation was achieved with OAuth by granting a scope that allowed access to the user's identity information. OpenID Connect standardises that scope.

share|improve this answer

Open id connect is build on the top of OAuth and hence it's more robust. OAuth is the protocol which is used only for the authorization and open id connect is very similar to OAuth but it combines the feature of OAuth also. You can start communication between your RP's and IP's using this protocol and their are various loop holes in OAuth protocol that's why better to use Open Id Connect.

share|improve this answer
Would be interesting to know why this answer got a downvote... – rdmueller Oct 11 '13 at 18:18
which loopholes are you referring to (honest curiosity).. I'm struggling with the same question as the OP. It seems oAuth2 (on which Openid Connect is based) already does authentication, although I'm familiar with the session-hijacking and MiM replay attackes possible with simple Bearer tokens. Are these the loopholes you're referring to? – Geert-Jan Oct 29 '13 at 20:48
@rdmueller - because it's grammatically suspect and makes vague claims. – Grant Birchmeier Sep 3 at 19:57

OpenID requires much less overhead on your part, as I understand it at least. OAuth is something you will have to implement yourself. Also as the comments suggest OAuth allows more sharing of more information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.