4 ms·
Authorization = Can I do this? Authentication = Am I this person? Technically, OAuth only cares about Authorization. It provides an opaque token to the client
by dexwiz 8y ago
Authorization = Can I do this?
Authentication = Am I this person?
Technically, OAuth only cares about Authorization. It provides an opaque token to the client that authorizes future requests. It doesn't tell the client anything about who the token is for.
Turns out most clients need to know who is logged in (such as loading basic profile information, email address, avatar, etc). In practice this is usually done through some sort of /user endpoint that accepts an OAuth token. This /user endpoint implementation is service specific.
OpenID Connect tries to fill that space by providing a standardized way to perform authentication and identity information.
- dwaite 8y agoMore than that, the bearer model of OAuth doesn't guarantee the token represents a particular user or even a particular client. Any assertion that you are dealing with a particular person needs to be targeted at you. There were security vulnerabilities with some early OAuth deployments that used OAuth for authentication which didn't understand this - and that allow one service that had a relationship with a user to act as that user against all other services which trusted that AS. For Facebook, they solve this by having the token stamp information about which client it was issued to, which the client is required to verify. For OpenID Connect, they decided to preserve the ability of OAuth access tokens to be opaque to the client, and create a new token called an id_token.