Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

Question

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third party.

However, I know a lot of people uses OAuth as authentication anyway, as illustrated here, Wikipedia calls it "pseudo-authentication", but it looks like a valid way to go. Is there any drawback compared to using OpenID? if OAuth is OK for authentication, does it mean that OAuth can do everything OpenID does, but OpenID can't do somethign that OAuth does (like accessing services). Why would people use OpenID as opposed to OAuth then?

Note: I am a beginner, so please excuse me and point out if I miss something fundamental here.

Answer 1

Whenever I compare the two I think of them as the difference between an active and passive identification/authentication model with openID being passive, OAuth active.

Passive tells the requesting application what to do, such as a web browser redirecting from identity provider to application, and the browser is a basic dumb client because it only does whats it's been told to do. Active requires that the requesting application know what to do when it's handed data, and it does whatever it wants with the data, e.g. the token.

Active models allow the application to make a direct request to an API with the users token because it's got the token stored locally. Passive models require the user to authenticate with a redirect to the provider, and return back to the application with a temporary token. (not technically temporary, but it fits the explanation)

Depending on what you are trying to do with your application, either model could work.