Open Authorization (OAuth)

What is OAuth?

OAuth (Open Authorization) is an open standard framework that enables third-party applications to obtain limited access to a user’s resources without exposing the user’s credentials. It is primarily used for authorization, allowing delegated access to protected resources such as APIs, data, or services.

Key Concepts of OAuth

• Resource Owner: The user who owns the data or resources.
• Client: The application requesting access to the user’s resources.
• Authorization Server: The server that authenticates the user and issues access tokens.
• Resource Server: The server hosting the protected resources (e.g., an API).
• Access Token: A credential used by the client to access protected resources on behalf of the user.

How OAuth Works

OAuth operates through a series of steps known as the authorization flow:

1. The client requests authorization from the resource owner.
2. The resource owner grants authorization, often via a consent screen.
3. The client exchanges the authorization grant for an access token from the authorization server.
4. The client uses the access token to request resources from the resource server.
5. The resource server validates the token and serves the requested resources.

Common Use Cases for OAuth

• Allowing a third-party app to post on a user’s social media account.
• Granting access to user data stored in cloud services (e.g., Google Drive, Dropbox).
• Enabling apps to read a user’s email or calendar without knowing their password.

What is OpenID Connect (OIDC)?

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth 2.0. It adds an identity layer to OAuth, enabling clients to verify the identity of the user and obtain basic profile information. While OAuth focuses on authorization, OIDC focuses on authentication.

Key Features of OIDC

• ID Token: A JSON Web Token (JWT) containing user identity information.
• UserInfo Endpoint: An API that returns claims about the authenticated user.
• Standard Scopes: Predefined scopes such as openid, profile, email, etc.
• Authentication Flows: Extends OAuth flows to include authentication steps.

How OIDC Works

OIDC builds upon the OAuth flow by adding authentication-specific steps:

1. The client requests authentication by including the openid scope.
2. The authorization server authenticates the user and returns both an access token and an ID token.
3. The client can use the ID token to verify the user’s identity and optionally call the UserInfo endpoint for additional claims.

Common Use Cases for OIDC

• Single Sign-On (SSO) for web and mobile applications.
• User authentication in modern applications (e.g., "Log in with Google").
• Federated identity across multiple services.

Key Differences Between OAuth and OIDC

Summary

OAuth is a framework for authorization, allowing third-party applications to access user resources without sharing credentials. OpenID Connect (OIDC) is an extension of OAuth 2.0 that adds authentication capabilities, enabling clients to verify user identity and retrieve profile information. While OAuth answers the question, "Can this app access my data?", OIDC answers, "Who is this user?".