A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication.

Since then though, pseudo-authentication using OAuth has become ubiquitous.

What made OpenID fail where OAuth succeeded? Was it just the inherent integration with an authorization framework alongside the pseudo-authentication framework?

  • OpenID Connect provides authentication on top of OAuth2's authorization. – Jacco Oct 8 '18 at 11:11

Most of the major OpenID providers decided to switch to OpenID Connect which is an OAuth based authentication system. One of their motives to do this ,rather than supporting both, may have been that the identity that is authenticated in OpenID Connect is, as far as I know, tied to the provider while original OpenID supported a fairly simple mechanism by which the owner of an ID could switch providers. If you want to control your own id with OpenID Connect you need to run your own provider.

Once the major OpenID providers switched to OpenID Connect the only game in town was Oauth based authentication.

  • OpenId Connect is build on top of OAuth2, which is quite different from OAuth. OAuth2 causes Provider lock-in by design. This design choice caused quite a bit of controversy when big tech companies pushed this change into the specification, in a late stage of writing the specifications. – Jacco Oct 8 '18 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.