Search code examples
oauth-2.0openidopenid-connectgoogle-oauthgoogle-openid

Is Stackoverflow's social auth mechanism (say I sign in with my Google account) built on top of OpenID Connect?


I am constantly get confused by OpenID Connect and Oauth2, and I read this article and get a sense that Google is using OpenID Connect https://auth0.com/docs/oauth-web-protocol (but I remember google used Oauth2 as providing auth service to 3rd parties), see the following quote

Auth0 supports the OpenID Connect / OAuth2 Login protocol. This is the protocol used by companies like Google, Facebook and Microsoft among others so there are plenty of libraries implementing it on various platforms.

Moreover, the above URL seems to say Auth0 is using OpenID (rather Oauth)? See the following quote:

GET https://YOUR_NAMESPACE/authorize/?
          response_type=code
          &client_id=YOUR_CLIENT_ID
          &redirect_uri=http://YOUR_APP/callback
          &state=VALUE_THAT_SURVIVES_REDIRECTS
          &scope=openid

http://openid.net/specs/openid-connect-basic-1_0.html


Solution

  • OpenID Connect is basically authentication built on top of OAuth 2.0.

    OAuth 2.0 by itself didn't standardise authentication (just authorization) and the confusion you have likely comes from the fact that each of the companies that are now switching to OIDC previously had already poured their own "authentication sauce" on over their OAuth 2.0 implementations. In practice this meant that each had their own set of scopes and their own version of what is a standard /userinfo endpoint in OIDC, but the authorization mechanism in all cases (including OIDC) is based on OAuth 2.0.

    To wrap up by answering your question: Yes, both of the endpoints you mention support OpenID Connect.