OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application).
OAuth2 offers the Resource Owner Password Credential Grant, which is rightly maligned by IAM experts as "The Devil".
A common pattern for OpenID Connect API is three steps:
1) Get a code
2) Get tokens like the
3) Get user info which contains claims like username, email, etc.
The schema for the id_token, which is a JWT, is defined in the OpenID Connect scope, as are many other details.
Another reason to use OpenID Connect is that there is a secure solution for centralized authentication for mobile software (at least IOS and Android). The current best practice defined by Google is to use new security features that block a mobile application from seeing cookies or credentials in a web view. Google published the AppAuth IOS and Android libraries because they really don't want you to leak Google credentials! As of the time of this writing, there are several OpenID Providers (aka IDP's...) that support the Google OpenID Connect AppAuth software, including: Google, OKTA, Ping, and my product Gluu.
- OAuth 2.0 for Native Apps draft-wdenniss-oauth-native-apps-02
- AppAuth for IOS
- AppAuth for Android