5 ms·

OAuth is for authorization, not authentication.

• aikah 11y ago
  "Alternatives" such as OpenID and Persona flopped though. So it is not like there is much choice anyway AFAIK.
• andersriutta 11y ago
  OpenID Connect [0] is "an interoperable authentication protocol based on the OAuth 2.0 family of specifications." Note this is a different protocol from OpenID 2.0. [0] http://openid.net/connect/faq/ http://openid.net/connect/faq/
  • dvanduzer 11y ago
    Yes, OpenID Connect is a protocol that builds on the authentication features developed from previous versions of OpenID, and merges it with the authorization features defined via OAuth. It is all laid out fairly clearly in this comment on the original blog post, for example: http://developer.telerik.com/featured/oauth-has-ruined-everything/?imm_mid=0dac54&cmp=em-web-na-na-newsltr_20151021#comment-2285976650 http://developer.telerik.com/featured/oauth-has-ruined-every...
• crashedsnow 11y ago
  That may have been the intent, but in a (very, very) large portion of cases the developer simply wants a way to verify identity claims. That is, verify that you are who you claim to be. 3rd party identity providers (Facebook et. al.) are a convenient way to do this, for both the user and the developer (maintaining your own passwords is a pain etc). It's coincidence that these providers choose oAuth for this, but you still end up with oAuth for identity, not auth'z.
  • dvanduzer 11y ago
    The phrase "verify identity claims" just means "authorize". There has never been a version of OAuth that would authenticate an identity. edit: Sorry, it's easy to understand how "verify identity claim" does sound like authentication. What it means for OAuth, is that a system authorizes access based on delegated authentication. So "verifying an identity claim" is binding a local authorization event to a remote authentication event. Or something.