3 ms·

OpenID doesn't provide API access like OAuth does, does it?

by daveid 8y ago

floatboth 8y ago
Exactly, it doesn't. Instead, OpenID had tons of weird bloat no one ever needed. XRI, XRDS, Yadis, WTF
raarts 8y ago
From Wikipedia : "the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[82] It allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain the basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format. OpenID Connect allows a range of organizations, including web-based, mobile and JavaScript clients, to request and receive information about authenticated sessions and end-users". My favorite implementation: Keycloak.
jakubriedl 8y ago
What do you mean by API access? OpenID Connect adds more features & standardization to OAuth2. So it supports everything that OAuth2 does. It all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" button.
- floatboth 8y ago
  When people talk about just "OpenID", they usually mean the original one, not Connect. The old OpenID did not have the ability to authenticate requests to the domain you signed in with. OpenID Connect adds lots of bloat, it's very large and complicated. IndieAuth is actually easy to understand and implement.
  - dwaite 8y ago
    Depends on your point of view. IndieAuth has a bunch of modifications to OAuth2 behaviors that may not be compatible with existing deployments, and requires software to implement things like full HTML parsing libraries to read out link tags. There were many incomplete OpenID 1/2 implementations, and compatibility greatly suffered as a result. As someone who maintained an OpenID 1/2 OP for a few years, I would much rather implement OpenID Connect Basic Profile than IndieAuth. IndieAuth, like OpenID 1/2, also assumes the user has a known profile page or even knows what a URL is, which are both statistically unlikely.

OpenID doesn't provide API access like OAuth does, does it?

by daveid 8y ago

OpenID doesn't provide API access like OAuth does, does it?

floatboth 8y ago

Exactly, it doesn't. Instead, OpenID had tons of weird bloat no one ever needed. XRI, XRDS, Yadis, WTF

raarts 8y ago

From Wikipedia : "the third generation of OpenID technology, OpenID Connect, is an authentication layer that sits on top of the OAuth 2.0 authorization framework.[82] It allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain the basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format. OpenID Connect allows a range of organizations, including web-based, mobile and JavaScript clients, to request and receive information about authenticated sessions and end-users". My favorite implementation: Keycloak.

jakubriedl 8y ago

What do you mean by API access? OpenID Connect adds more features & standardization to OAuth2. So it supports everything that OAuth2 does. It all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" button.

floatboth 8y ago
When people talk about just "OpenID", they usually mean the original one, not Connect. The old OpenID did not have the ability to authenticate requests to the domain you signed in with. OpenID Connect adds lots of bloat, it's very large and complicated. IndieAuth is actually easy to understand and implement.
- dwaite 8y ago
  Depends on your point of view. IndieAuth has a bunch of modifications to OAuth2 behaviors that may not be compatible with existing deployments, and requires software to implement things like full HTML parsing libraries to read out link tags. There were many incomplete OpenID 1/2 implementations, and compatibility greatly suffered as a result. As someone who maintained an OpenID 1/2 OP for a few years, I would much rather implement OpenID Connect Basic Profile than IndieAuth. IndieAuth, like OpenID 1/2, also assumes the user has a known profile page or even knows what a URL is, which are both statistically unlikely.