To understand something, look at its history. OpenID & OAuth started on parallel tracks and have since merged somewhat into OpenID Connect. I've changed their terminology for simplicity's sake.
OpenID 1.0 (2006) lets an app ask an authority for proof that an end user owns an identify (a URL).
- End user to app: I am Steve A. Smith.
- App to authority: Is this Steve A. Smith?
- The end user and authority speak for a moment.
- Authority to app: Yes, that is Steve A. Smith.
OpenID 2.0 (2007) does the same, but adds a second identity format (XRI) and adds flexibility to how the end user specifies the identity and authority.
OpenID Attribute Exchange 1.0 (2007) extends OpenID 2.0 by letting an app fetch & store end user profile information with the authority.
- End user to app: I am Steve A. Smith.
- App to authority: Is this Steve A. Smith? If it is, also fetch me his email address and phone number.
- The end user and authority speak for a moment.
- Authority to app: Yes, that is Steve A. Smith with email [email protected] and phone 123-456-7890.
OAuth 1.0 (2010) lets an end user grant an app limited access to resources on a third-party server that an authority owns.
- App to end user: We'd like to access your pictures on some other server.
- The end user and authority speak for a moment.
- Authority to app: Here is an access token.
- App to third-party server: Here is the access token that proves I am allowed to access pictures for an end user.
OAuth 2.0 (2012) does the same thing as OAuth 1.0 but with a completely new protocol.
OpenID Connect (2014) combines the features of OpenID 2.0, OpenID Attribute Exchange 1.0, and OAuth 2.0 in a single protocol. It allows an application to use a third-party to...
- to verify the end user's identity,
- to fetch the end user's profile info, and
- to gain limited resource access.