Skip to main content
Information Security

Return to Answer

replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link
Community Bot
Community Bot
  • 1

Simple Terms

  1. OpenID is about verifying a person's identity (authentication).
  2. OAuth is about accessing a person's stuff (authorization).
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity (authentication).
  2. OAuth is about accessing a person's stuff (authorization).
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity (authentication).
  2. OAuth is about accessing a person's stuff (authorization).
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.
Added clarification
Source Link
edit approved Aug 7, 2019 at 1:59
GFoley83
edit approved Aug 7, 2019 at 1:59
GFoley83
  • 103
  • 4

Simple Terms

  1. OpenID is about verifying a person's identity (authentication).
  2. OAuth is about accessing a person's stuff (authorization).
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity.
  2. OAuth is about accessing a person's stuff.
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity (authentication).
  2. OAuth is about accessing a person's stuff (authorization).
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.
added 1 character in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13

Simple Terms

  1. OpenID is about verifying a person's identity.
  2. OAuth is about accessing a person's stuff.
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity.
  2. OAuth is about accessing a person's stuff.
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.

Simple Terms

  1. OpenID is about verifying a person's identity.
  2. OAuth is about accessing a person's stuff.
  3. OpenID Connect does both.

All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app.

More Details

To understand something, look at its history.

OpenID & OAuth have developed on parallel tracks and in 2014 merged into OpenID Connect. Throughout their history, OpenID and OAuth have let an app use a trusted authority to handle private user credentials. Whereas OpenID let the authority verify a user's identity, OAuth let the authority grant limited access to a user's stuff.

OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith?
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith.

OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.

OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority - in addition to verifying the end user's identity.

  • End user to app: I am Steve A. Smith.
  • App to authority: Is this Steve A. Smith? Oh, and if it is, also fetch me his email address and phone number.
  • The end user and authority speak for a moment.
  • Authority to app: Yes, that is Steve A. Smith. His email is [email protected] and phone number is 123-456-7890.

OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.

  • App to end user: We'd like to access your pictures on some other server.
  • The end user and authority speak for a moment.
  • Authority to app: Here is an access token.
  • App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.

OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.

OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use an authority...

  1. to verify the end user's identity,
  2. to fetch the end user's profile info, and
  3. to gain limited access to the end user's stuff.
added 9 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 9 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 9 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 177 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 165 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 165 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
added 131 characters in body
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13
Source Link
Shaun Luttin
Shaun Luttin
  • 1.5k
  • 3
  • 12
  • 13