OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application).
OAuth2 offers the Resource Owner Password Credential Grant, which is rightly maligned by IAM experts as "The Devil".
A common pattern for OpenID Connect API is three steps:
1) Get a code
2) Get tokens like the
3) Get user info which contains claims like username, email, etc.
The schema for the id_token, which is a JWT, is defined in the OpenID Connect scope, as are many other details.
If you want to deploy an OpenID Provider (i.e. Be your own Google...) you can try the free open source Gluu Server which has packages for Centos, Ubuntu, Red Hat, and Debian. Gluu also publishes client software called oxd, which provides a native client libraries for node, php, python, ruby, java and the spring framework. There are also oxd plugins for several open source products like Wordpress, Magento, Drupal, OpenCart, SugarCRM, SuiteCRM, RoundCube, Liferay and the Play Framework.
Another reason to use OpenID Connect is that there is a secure solution for centralized authentication for mobile software (at least IOS and Android). The current best practice defined by Google is to use new security features that block a mobile application from seeing cookies or credentials in a web view. Google published the AppAuth IOS and Android libraries because they really don't want you to leak Google credentials! As of the time of this writing, there are several OpenID Providers (aka IDP's...) that support the Google OpenID Connect AppAuth software, including: Google, OKTA, Ping, and Gluu.
- OAuth 2.0 for Native Apps draft-wdenniss-oauth-native-apps-02
- AppAuth for IOS
- AppAuth for Android