OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

learn more… | top users | synonyms

6
votes
1answer
146 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
0
votes
1answer
26 views

How is using an endpoint for public keys secure?

OpenID Connect has discovery endpoints containing a JKWS endpoint to get public keys to validate Identity and Access tokens. So for example: I have a desktop application which gets an Identity ...
4
votes
1answer
58 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
0
votes
0answers
141 views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
2
votes
0answers
113 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
1answer
49 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a ...
1
vote
0answers
33 views

OpenID Connect in browser audience verification

With OpenID Connect it's required to validate the ID Token audience claim to make sure the access token was issued for this specific client in order to prevent the Confused Deputy Problem. Now, in a ...
2
votes
0answers
34 views

OpenID Connect access token to access protected API

In our setup we need both reliable user authentication and scope-based authorization. Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client ...
1
vote
0answers
61 views

Confirm signature of JWT or make API call (JWT vs. oauth)

Given a setup where user credentials are stored on a server, but web services will be called from third-party clients, does the following seem reasonable: When clients want to login, they send ...
1
vote
1answer
61 views

Does OpenID Connect Hybrid Flow return ID Token on /token endpoint?

In OpenID Connect, there is a flow called "hybrid flow". The hybrid flow returns, depending on the response_type (e.g. id_token code, id_token code token), the ID token immediately. My question wether ...
5
votes
1answer
61 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
1
vote
0answers
49 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
1
vote
2answers
641 views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
0
votes
1answer
65 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
2
votes
1answer
105 views

Any issue with allowing CORS on an oauth2 endpoint

I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match. This way a RP would be able to get a response ...
0
votes
1answer
210 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
1
vote
1answer
46 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
-1
votes
1answer
768 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
0
votes
0answers
33 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
20
votes
2answers
6k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
3
votes
1answer
143 views

In OpenId Connect, why aren't requested claims included in the Id Token?

In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client. ...
2
votes
1answer
177 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
1answer
124 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
0
votes
1answer
341 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
339 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
4
votes
2answers
568 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
8
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
512 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
10
votes
2answers
7k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User "...
47
votes
2answers
26k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
40
votes
7answers
24k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...