8

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it looks like you receive both an ID Token and an Access token upon success. But what if I don't care about authorization here. Can I omit the Access token from the protocol? Are there better protocols to use if I'm only interested in authentication (e.g. SAML)?

Improve this question

1 Answer 1

Reset to default
5

Looks like I found the answer on Access Token:

UserInfo Endpoint

It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary information for processing the authentication event. However, in order to provide compatibility with OAuth and match the general tendency for authorizing identity and other API access in parallel, OpenID Connect always issues the ID token along side an OAuth access token.

http://oauth.net/articles/authentication/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .