OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it looks like you receive both an ID Token and an Access token upon success. But what if I don't care about authorization here. Can I omit the Access token from the protocol? Are there better protocols to use if I'm only interested in authentication (e.g. SAML)?


Looks like I found the answer on Access Token:

UserInfo Endpoint

It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary information for processing the authentication event. However, in order to provide compatibility with OAuth and match the general tendency for authorizing identity and other API access in parallel, OpenID Connect always issues the ID token along side an OAuth access token.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.