Open ID Connect and OAuth 2

The purpose of OpenID Connect is to add authentication functionality to the authorization functions of OAuth ( Font ). That is, in fact the purpose of OpenID and OAuth are different, and the problem is that a lot of people were using OAuth for authentication (ie proving what the user is who they say it is) when in fact it was designed to provide authorization (ie determine what an agent can or can not do on behalf of a user). Some people say that OAuth alone only supports "pseudo-authentication" (whatever that means).

This question in security.SE has some additional information (for example, citing the OpenID Connect uses JWT , which standardizes several aspects making the code simpler, as well as the way the user chooses its provider, etc.), but at the that I understood the main difference is this same. I have no practical experience with any of the two protocols, however, so I would not be able to comment on all the implications of using one protocol or another (for example, it is assumed that ad-hoc OAuth is less than "real" authentication, but I could not tell if this is true or how bad it is).

OpenID does not extend OAuth it uses OAuth as its base becoming layer over Oauth . Oauth is pure delegation without any sense of identity.

That said, I simplify the application of both as follows:

While OAuth defines secure ways to authorize applications and access certain contexts and content, in particular it defines how to do it, over HTTP, and so on. The OpenID defines a JSON structure that allows you to identify users, devices, etc.

Together they produce a token that contains standardized useful information that can let you know:

... this by any application, know exactly if the rules of both protocols are fulfilled.

In order to guarantee authenticity, the OpenID protocol still defines concepts as a Identity Provider that generate digitally signed tokens so that its credibility is assured, but on the basis of trust.