Questions tagged [openid-connect]

OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

Filter by
Sorted by
Tagged with
3
votes
2answers
119 views

Is it reasonable to allow Google sign-in for people who signed up “normally”?

I've been thinking - let's say a user signs up for your site in the "standard" way. That is, they enter an e-mail address, maybe a user name, and a password, and complete the sign-up process. Is it ...
2
votes
1answer
521 views

What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC?

Of all the issuers I've found, (Facebook, Twitter, Azure AD, etc) only Apple's CloudKit has the feature of "post message" as a callback (unless it's buried in the other's SDK) Here is a screenshot of ...
4
votes
1answer
1k views

Why does OpenID Connect use id token as a querystring parameter on logout?

OpenID Connect, in the implicit flow, returns the id token as a #fragment on the return URI specifically so that the id token doesn't get logged in web server logs. However, the OpenID Connect logout ...
0
votes
1answer
177 views

What is the difference of the word “Open” in OpenID vs. OpenID Connect

I am having a hard time in understanding the concept of OpenId and OpenId Connect. Both of them have the word "Open" in them but there is a difference in the meaning. Why is this so?
1
vote
0answers
680 views

Is it enough to check the Audience of OAuth2 Access tokens?

I am investigating using Social Login for a web service fronted by Web-based portals and Mobile applications. The idea is to "Authenticate" the user and let the service create an "API-Key" once the ...
1
vote
1answer
415 views

Why are Synchronization Token and Cookie-to-Header patterns un-natural for Web APIs?

I have heard that CSRF prevention techniques are not natural for Web APIs. For instance, we might have a client application at domainA that implements both the Synchronization Token Pattern and the ...
1
vote
0answers
292 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
6
votes
2answers
2k views

How would replacing Bearer tokens with HMAC work in OAuth 2.0, and how would the client/server validate?

This Pluralsight class discusses Bearer tokens, and that one of the things missing from OAuth 2.0 is HMAC based validation. Elsewhere on the thinktecture blogs, they are called PoP tokens (Proof of ...
0
votes
0answers
2k views

View the access code, access token, and id token from Google during an OpenID Connect flow

Situation We're wanting to use an HTTP logger/proxy/analyzer to inspect the access code, access token, and id token that are part of the code flow. The flow is happening among Google (the ...
14
votes
1answer
12k views

OIDC Flow for SPA and RESTful API

I'm building a Single-Page App (SPA) and a RESTful API. The API needs security - certain users can only make calls to certain endpoints. I have an external Identity Provider (IdP (Okta)) that I want ...
11
votes
1answer
1k views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
0
votes
1answer
285 views

How is using an endpoint for public keys secure?

OpenID Connect has discovery endpoints containing a JKWS endpoint to get public keys to validate Identity and Access tokens. So for example: I have a desktop application which gets an Identity token ...
6
votes
1answer
497 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
18
votes
1answer
21k views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
2
votes
0answers
172 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
1answer
136 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
1
vote
0answers
153 views

OpenID Connect in browser audience verification

With OpenID Connect it's required to validate the ID Token audience claim to make sure the access token was issued for this specific client in order to prevent the Confused Deputy Problem. Now, in a ...
2
votes
1answer
274 views

OpenID Connect access token to access protected API

In our setup we need both reliable user authentication and scope-based authorization. Consider the following scenario: a user logs in into our client (portal) using OpenID Connect, and our client ...
2
votes
0answers
204 views

Confirm signature of JWT or make API call (JWT vs. oauth)

Given a setup where user credentials are stored on a server, but web services will be called from third-party clients, does the following seem reasonable: When clients want to login, they send ...
2
votes
1answer
612 views

Does OpenID Connect Hybrid Flow return ID Token on /token endpoint?

In OpenID Connect, there is a flow called "hybrid flow". The hybrid flow returns, depending on the response_type (e.g. id_token code, id_token code token), the ID token immediately. My question wether ...
7
votes
1answer
366 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
1
vote
0answers
351 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
12
votes
2answers
20k views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
0
votes
1answer
163 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
3
votes
1answer
510 views

Any issue with allowing CORS on an oauth2 endpoint

I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match. This way a RP would be able to get a response ...
0
votes
1answer
847 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
1
vote
1answer
60 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
0
votes
2answers
3k views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
37
votes
2answers
21k views

OAuth 2 vs OpenID Connect to secure API

I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an ...
3
votes
1answer
718 views

In OpenId Connect, why aren't requested claims included in the Id Token?

In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client. ...
3
votes
3answers
1k views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
1answer
251 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
2
votes
1answer
914 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
0answers
823 views

Facebook Login and OpenID Connect [closed]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
4
votes
2answers
787 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
8
votes
4answers
2k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
768 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
26
votes
3answers
22k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User "Bob"...
142
votes
7answers
85k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
116
votes
6answers
84k views

Why use OpenID Connect instead of plain OAuth2?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...

1 2 3