OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

learn more… | top users | synonyms

0
votes
0answers
27 views

Do I need my own oauth and/or openid connect provider

I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...
0
votes
0answers
48 views

Why OpenID Connect instead OAuth 2.0?

My life was very happy when I was using OAuth 2.0 tokens with grant_type=Password. My App flow: User authentication before giving OAuth tokens (AT and RT). Access token validation when user opt for ...
2
votes
0answers
61 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
1
vote
1answer
57 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
0
votes
1answer
93 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
93 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
4
votes
2answers
374 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
6
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
317 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
4
votes
2answers
3k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
16
votes
2answers
10k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
19
votes
5answers
9k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...