OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

learn more… | top users | synonyms

1
vote
0answers
98 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
1answer
40 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a ...
1
vote
0answers
26 views

OpenID Connect in browser audience verification

With OpenID Connect it's required to validate the ID Token audience claim to make sure the access token was issued for this specific client in order to prevent the Confused Deputy Problem. Now, in a ...
1
vote
0answers
24 views

OpenID Connect access token to access protected API

In our setup we need both reliable user authentication and scope-based authorization. Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client ...
1
vote
0answers
45 views

Confirm signature of JWT or make API call (JWT vs. oauth)

Given a setup where user credentials are stored on a server, but web services will be called from third-party clients, does the following seem reasonable: When clients want to login, they send ...
0
votes
1answer
33 views

Does OpenID Connect Hybrid Flow return ID Token on /token endpoint?

In OpenID Connect, there is a flow called "hybrid flow". The hybrid flow returns, depending on the response_type (e.g. id_token code, id_token code token), the ID token immediately. My question wether ...
4
votes
1answer
45 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
1
vote
0answers
39 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
0
votes
2answers
259 views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
0
votes
1answer
54 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
2
votes
1answer
81 views

Any issue with allowing CORS on an oauth2 endpoint

I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match. This way a RP would be able to get a response ...
0
votes
1answer
179 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
1
vote
1answer
45 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
-1
votes
1answer
613 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
0
votes
0answers
33 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
15
votes
2answers
4k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
0
votes
0answers
29 views

Is it possible/sensible to split an OpenID Connect endpoint into multiple endpoints?

I just created an OpenID Connect auth* service to see how it works and if we can make use of it at work. I understand some of it; I wrote a couple client apps that use the implicit flow for user login ...
3
votes
1answer
121 views

In OpenId Connect, why aren't requested claims included in the Id Token?

In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client. ...
0
votes
0answers
130 views

Do I need my own oauth and/or openid connect provider

I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...
2
votes
0answers
166 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
1answer
121 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
0
votes
1answer
306 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
315 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
4
votes
2answers
559 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
8
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
492 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
8
votes
2answers
6k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
42
votes
2answers
23k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
35
votes
6answers
21k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...