DRAFT
To understand something, look at its history. OpenID & OAuth started on parallel tracks and have since merged somewhat into OpenID Connect.
OpenID 1.0 (2006) lets a consumer ask an identity provider for proof that an end user owns an identifier. This identifier (openid.identity) is just a URL.
- End user to consumer: I am Steve A. Smith.
- Consumer to identity provider: Is this Steve A. Smith?
- The end user and identity provider speak for a moment.
- Identity provider to consumer: Yes, that is Steve A. Smith.
OpenID 2.0 (2007) does the same, but adds a second identifier format (XRI) and flexibility around how the end user specifies an identifier and identity provider.
OAuth 1.0 ...
OAuth 2.0 ...
OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting the consumer fetch & store end user profile information with the identity provider. It uses the OpenID.axschema to send profile data.
- End user to consumer: I am Steve A. Smith.
- Consumer to identity provider: Is this Steve A. Smith? If it is, also fetch me his email address and phone number.
- The end user and identity provider speak for a moment.
- Identity provider to consumer: Yes, that is Steve A. Smith with email [email protected] and phone 123-456-7890.
OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows a web application to use a third-party...
- to verify the end user's identity,
- to fetch the end user's profile info, and
- to gain limited resource access.