I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides authentication by abusing oAuth authorization.
Why the derogative tone? There is a very strong implication that this is bad, but I have not found any explanations for this, and while I understand the difference between authentication and authorization, I don't understand where anybody would use authorization without authentication, or more accurately, without attributability.
Actually that's not true, if I try I can think of situations where attributability is not important, but that won't work for my situation: I'm working on an online service which will allow registrations from users using FB, Twitter, Google+ and probably LinkedIn for authentication. The Front-end applications (web based and mobile, potentially controlled by third parties) should from my understanding use oAuth for access to the API/back-end services on a user's behalf.
For example, if I get a request from a front-end mobile app or a web site to access a user's messages, maybe like:
I would need to know that the user signed into the application or web-site is not just authorized to read the messages resource, but that it is in fact the user who may read that specific mailbox.
But I digress, so: Is OpenID Connect bad somehow? I've seen the Wikipedia diagram ... can someone please explain what is wrong with that picture?
I'm ultimately trying to figure out what are all the pieces of the puzzle to create an architechture where:
a) Users register on the back-end and are authenticated via
OpenID / Google / FB / etc
b) Users access the service via an independent front-end, eg a mobile app or web-site
c) Different users have different roles (Eg Staff and Customers) and can not access each other's personal or sensitive data
d) It is a multi-tenant service, so Staff from company A could actually be customers of company B and Company C!
FWIW: Some things that I've seen, which helps to confuse/clarify things for me:
- oAuth 2.0 provides Authorization
- The page above says oAuth is meant to provide authorization without sharing identification; then how is attributability achieved?
- OpenID Connect uses oAuth 2.0 and provides authentication
- The page mentioned above states that oAuth 2.0 was designed to support development of Authorization AND AUTHENTICATION PROTOCOLS
- Does OpenID Connect then provide both Authentication AND Authorization?