Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.

share|improve this question

2 Answers 2

up vote 14 down vote accepted

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do.

In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name and password) are sent to another server, B, that A trusts (at least, trusts for authenticating users). Indeed, server B makes sure that U is indeed U, and then tells to A: "ok, that's the genuine U".

In OAuth, authorization is delegated: entity A obtains from entity B an "access right" which A can show to server S to be granted access; B can thus deliver temporary, specific access keys to A without giving them too much power. You can imagine an OAuth server as the key master in a big hotel; he gives to employees keys which open the doors of the rooms that they are supposed to enter, but each key is limited (it does not give access to all rooms); furthermore, the keys self-destruct after a few hours.

To some extent, authorization can be abused into some pseudo-authentication, on the basis that if entity A obtains from B an access key through OAuth, and shows it to server S, then server S may infer that B authenticated A before granting the access key. So some people use OAuth where they should be using OpenID. This schema may or may not be enlightening; but I think this pseudo-authentication is more confusing than anything. OpenID Connect does just that: it abuses OAuth into an authentication protocol. In the hotel analogy: if I encounter a purported employee and that person shows me that he has a key which opens my room, then I suppose that this is a true employee, on the basis that the key master would not have given him a key which opens my room if he was not.

share|improve this answer
    
Great Thanks. Can you just explain it in English jargon instead of server jargon. I like the hotel example. But for explaing the OPENID(first paragraph) you are using Server word –  user960567 Oct 29 '13 at 14:08
5  
"Server" here means "a computer which sits in some room, waiting for data to come through the network, and then responds to it". That's hardly jargon. –  Thomas Pornin Oct 29 '13 at 14:15
    
@user960567 at some point you can't really distill details or ideas any further by switching 'jargons', especially when dealing with complex topics like authentication, authorization, or delegation. –  Steve Oct 29 '13 at 16:37
    
@ThomasPornin: Wouldn't you say that OAuth is about authorization AND authentication? Because authentication is always the base of a successful authorization, isn't it? Although in your example of OAuth (at least in the Authorization Grant Type) authentication takes place on the server of entity B where authorization is done on Server S. Right? –  pfust75 Oct 30 '13 at 6:53
    
@ThomasPornin, Hey expert please check this, there are lot of confusion out there, security.stackexchange.com/questions/44843/… –  user960567 Nov 4 '13 at 5:35

Many people still visit this so here's a very simple diagram to explain it

enter image description here

Courtesy Wikipedia

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.