OAuth vs. OpenID – What’s the difference

1. OAuth vs. OpenID what’s the difference? First of all, saying either OAuth or OpenID is not specific enough. There are at least three versions of both. The IETF OAuth standard is OAuth 2.0, and is an authorization standard. However, you could define a profile of OAuth 2.0 for anything. “OpenID Connect” (not OpenID 1 or OpenID 2…) is in fact such a profile of OAuth 2.0 that defines a workflow for authentication. It is quite close to Google’s authentication API. The great thing about OpenID Connect is that we had too many proprietary API’s that did the same thing: authenticated a person. For example, Google and Face book both used OAuth 2.0 differently, as did a plethora of other websites (see everyauth). OpenID Connect represents years of work to align consumer IDPs (i.e. MSFT, Google, Yahoo…) and other industry participants on a single profile of OAuth 2.0 for authentication. Along the way, OpenID Connect also defines standards for Discovery (Web finger),

2. Dynamic Client Registration (so you don’t have to ask every website for a client id and password manually…), and session management (logout). For more information feel free to visit Gluu.org. Also, the OX platform offers a free open source implementation of an OpenID Connect OP (OpenID Provider… like a SAML IDP). There is plenty of client code out there to utilize an OpenID Connect OP: if you can’t find a specific library for OpenID Connect, just use the OAuth2 client library for your platform, and start with the Google workflow, and you’ll have to make some minor adjustments. Article resource: - http://www.blogster.com/thegluuserver/oauth-vs-openid-whats-the-difference