OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

learn more… | top users | synonyms

0
votes
1answer
35 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
1
vote
1answer
41 views

Any issue with allowing CORS on an oauth2 endpoint

I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match. This way a RP would be able to get a response ...
0
votes
1answer
136 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
2
votes
1answer
42 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
0
votes
1answer
322 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
0
votes
0answers
32 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
11
votes
2answers
2k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
0
votes
0answers
26 views

Is it possible/sensible to split an OpenID Connect endpoint into multiple endpoints?

I just created an OpenID Connect auth* service to see how it works and if we can make use of it at work. I understand some of it; I wrote a couple client apps that use the implicit flow for user login ...
3
votes
1answer
91 views

In OpenId Connect, why aren't requested claims included in the Id Token?

In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client. ...
0
votes
0answers
110 views

Do I need my own oauth and/or openid connect provider

I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...
0
votes
0answers
64 views

Why OpenID Connect instead OAuth 2.0? [duplicate]

My life was very happy when I was using OAuth 2.0 tokens with grant_type=Password. My App flow: User authentication before giving OAuth tokens (AT and RT). Access token validation when user opt for ...
2
votes
0answers
141 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
1answer
110 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
0
votes
1answer
243 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
231 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
4
votes
2answers
525 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
8
votes
4answers
1k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
462 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
8
votes
2answers
5k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
33
votes
2answers
19k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
33
votes
6answers
18k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...