Search code examples
asp.netidentityserver4openid

What's the difference between IdentityResources OpenId, Email and Profile?

Reading the Identity server docs at 'https://docs.identityserver.io/en/3.1.0/topics/resources.html', I am confused with IdentityResources. There are

  • IdentityResources.OpenId()
  • IdentityResources.Email()
  • IdentityResources.Profile()

First of all what is OpenId() in this context? What are the differences between these three? For my case, my users are able to login with their email or username. Which should I use?

Thanks!

Solution

  • OpenId, Email and Profile are scopes, things that the client application can ask IdentityServer for.

    These three scopes will then map to claims that then will end up in the Id-Token

    The openid scope is a special scope that always must be included and that will one ask for the users (sub) unique identifier (userid). the Email will ask for the email details and the profile scope will ask for the profile details (webpage, gender...)

    Just like this picture below shows. The requested scopes will control what will end up in the ID-token and access-token.

    enter image description here

    To complement this answer, I wrote a blog post that goes into more detail about this topic: IdentityServer – IdentityResource vs. ApiResource vs. ApiScope