Search code examples
oauthoauth-2.0openidopenid-connect

What is the difference between openid, oauth1.0, oauth1.0a ,oauth2.0 and open id connect?


Please tell me the difference between these third party authentications i.e open id, o-auth1.0, o-auth1.0a ,o-auth2.0 and open id connect. Well i googled on this but not able to find the exact difference between all these. All the time I got difference between o-auth and open id but not about all these together.

Any reference or any explanation would be appreciated. Thanks in advance.


Solution

  • First of all, note the difference between authentication and authorization: not all the protocols in your question actually do authentication.

    During authentication you prove your identity to someone else (e.g. show driving license), see OpenId.

    During authorization you give access rights to someone else to use a protected resource (e.g. give car keys), probably without exposing your identity, see OAuth. OAuth 1.0 works, but a common complaint is that both server and client has to do a lot of cryptography, so it's not lightweight on the client side and does not support embedded clients (e.g. javascript). OAuth 1.0a addressed a security issue, but it's obsolete, the fix was included into the original spec (RFC 5849). OAuth 2.0 supports both remote web application and embedded/javascript clients and allows implementing a client application much easier.

    OpenId Connect unites OpenId and OAuth (thus providing both authentication and authorization) as a small extension to the OAuth 2.0 protocol.