1 / 2

OAuth vs. OpenID – What’s the difference

There is plenty of client code out there to utilize an OpenID Connect OP: if you can’t find a specific library for OpenID Connect, just use the OAuth2 client library for your platform, and start with the Google workflow, and you’ll have to make some minor adjustments.

gluu
Download Presentation

OAuth vs. OpenID – What’s the difference

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. OAuth vs. OpenID what’s the difference? First of all, saying either OAuth or OpenID is not specific enough. There are at least three versions of both. The IETF OAuth standard is OAuth 2.0, and is an authorization standard. However, you could define a profile of OAuth 2.0 for anything. “OpenID Connect” (not OpenID 1 or OpenID 2…) is in fact such a profile of OAuth 2.0 that defines a workflow for authentication. It is quite close to Google’s authentication API. The great thing about OpenID Connect is that we had too many proprietary API’s that did the same thing: authenticated a person. For example, Google and Face book both used OAuth 2.0 differently, as did a plethora of other websites (see everyauth). OpenID Connect represents years of work to align consumer IDPs (i.e. MSFT, Google, Yahoo…) and other industry participants on a single profile of OAuth 2.0 for authentication. Along the way, OpenID Connect also defines standards for Discovery (Web finger),

  2. Dynamic Client Registration (so you don’t have to ask every website for a client id and password manually…), and session management (logout). For more information feel free to visit Gluu.org. Also, the OX platform offers a free open source implementation of an OpenID Connect OP (OpenID Provider… like a SAML IDP). There is plenty of client code out there to utilize an OpenID Connect OP: if you can’t find a specific library for OpenID Connect, just use the OAuth2 client library for your platform, and start with the Google workflow, and you’ll have to make some minor adjustments. Article resource: - http://www.blogster.com/thegluuserver/oauth-vs-openid-whats-the-difference

More Related