Timeline for Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 12, 2023 at 2:50 | comment | added | Ash | It should be noted that OpenID is a protocol for authentication delegation, and not for the actual authentication procedure itself. As per the spec: "The methods used by the Authorization Server to Authenticate the End-User (e.g. username and password, session cookies, etc.) are beyond the scope of this specification." | |
| Oct 5, 2018 at 18:21 | comment | added | bruno.bologna | Great explanation! I was using OAuth to Authenticate. You saved my day man! | |
| Aug 22, 2018 at 2:09 | comment | added | jpmc26 | So OpenID is about letting users log in using another service. OAuth is about letting some server do stuff on your behalf. Right? In some sense, they seem to be going in opposite directions. | |
| Sep 25, 2016 at 8:18 | comment | added | Ber | According to the link BenV provided, OpenID Connect does not even support a separate OpenID protocol anymore. Instead it is a pseudo-authentication layer built entirely on OAuth 2.0, requiring the user give the site access to his e.g. Google account and allowing both sites to monitor the users' activity of the other. Is this true?? Does OpenID exist as a separate protocol anymore? | |
| Sep 25, 2016 at 7:56 | comment | added | Ber | @BenV according to the page you linked, Google now uses ONLY OAuth 2.0 functionality within OpenID Connect. They've stopped supporting OpenID 2.0 in favor of OAuth 2.0 merely because the latest version of OpenID has support for OAuth, without making it clear to the user the apparent vast differences that I'm still trying to figure out. This would seem to suggest OpenID in and of itself is no longer used?? | |
| Aug 17, 2016 at 21:53 | history | rollback | Thomas Pornin |
Rollback to Revision 1
|
|
| S Aug 17, 2016 at 17:29 | history | suggested | David Brossard | CC BY-SA 3.0 |
updated the term authorization
|
| Aug 17, 2016 at 16:43 | review | Suggested edits | |||
| S Aug 17, 2016 at 17:29 | |||||
| Jan 21, 2015 at 10:34 | comment | added | Johan | OK, so A is the Consumer and B is the ID-provider. What is Server S? | |
| Jan 3, 2015 at 21:25 | comment | added | BenV | @GayanSanjeewa And now they don't. | |
| May 19, 2014 at 1:34 | comment | added | GayanSanjeewa | It seems this distinction: "OpenID is a protocol for authentication while OAuth is for authorization" is no longer valid. Google use OAUTH 2.0 for both authentication and authorization now (developers.google.com/accounts/docs/OAuth2Login) | |
| Feb 20, 2014 at 0:12 | comment | added | cobra libre | @ThomasPornin, a hotel room key is analogous to an OAuth 2 access/bearer token; it is not analogous to an OpenID Connect ID token. | |
| Nov 4, 2013 at 5:35 | comment | added | Imran Qadir Baksh - Baloch | @ThomasPornin, Hey expert please check this, there are lot of confusion out there, security.stackexchange.com/questions/44843/… | |
| Oct 30, 2013 at 6:53 | comment | added | pfust75 | @ThomasPornin: Wouldn't you say that OAuth is about authorization AND authentication? Because authentication is always the base of a successful authorization, isn't it? Although in your example of OAuth (at least in the Authorization Grant Type) authentication takes place on the server of entity B where authorization is done on Server S. Right? | |
| Oct 29, 2013 at 16:37 | comment | added | Steve | @user960567 at some point you can't really distill details or ideas any further by switching 'jargons', especially when dealing with complex topics like authentication, authorization, or delegation. | |
| Oct 29, 2013 at 14:26 | vote | accept | Imran Qadir Baksh - Baloch | ||
| Oct 29, 2013 at 14:15 | comment | added | Thomas Pornin | "Server" here means "a computer which sits in some room, waiting for data to come through the network, and then responds to it". That's hardly jargon. | |
| Oct 29, 2013 at 14:08 | comment | added | Imran Qadir Baksh - Baloch | Great Thanks. Can you just explain it in English jargon instead of server jargon. I like the hotel example. But for explaing the OPENID(first paragraph) you are using Server word | |
| Oct 29, 2013 at 13:52 | history | answered | Thomas Pornin | CC BY-SA 3.0 |