OAuth 2.0 and OpenID Connect (OIDC)

🔐 OAuth 2.0 and OpenID Connect (OIDC)

They’re closely related, but they serve different purposes:

🧩 OAuth 2.0 — Delegated Authorization

💡 Definition

OAuth 2.0 is an open standard that allows users to grant a third-party app limited access to their resources on another service — without sharing their password.

🎯 Purpose

“Let this app do something on my behalf.”

🔄 Example: OAuth 2.0 Flow (Real-world)

You’re using a fitness app that wants to read your Google Fit data.

1. The app redirects you to Google’s authorization page.
2. You log into Google and see a consent screen:
   “Allow this app to view your Google Fit data?”
3. If you agree, Google issues the app an Access Token.
4. The app uses that token to fetch your fitness data — without ever seeing your Google password.

⚙️ OAuth 2.0 Key Roles

🔑 OAuth 2.0 Tokens

🔄 OAuth 2.0 Grant Types (Flows)

🧭 OpenID Connect (OIDC) — Authentication Layer

💡 Definition

OpenID Connect (OIDC) is a simple identity layer built on top of OAuth 2.0 that allows clients to verify the user’s identity and obtain basic profile information.

While OAuth 2.0 says:

“App A is allowed to access user’s data.”

OIDC adds:

“And the user’s name is Alice, with email alice@example.com.”

🧠 How OIDC Works (Simplified)

1. The app (client) redirects you to the identity provider (like Google).
2. You log in once.
3. The IdP sends back:
   • An ID Token (JWT) → proves your identity.
   • An Access Token → allows the app to access APIs.
4. The app uses the ID Token to authenticate you.

🧾 Example of an ID Token (JWT)

{
  "iss": "https://accounts.google.com",
  "sub": "1122334455",
  "email": "alice@gmail.com",
  "name": "Alice Johnson",
  "iat": 1739050000,
  "exp": 1739053600
}

{
  "iss": "https://accounts.google.com",
  "sub": "1122334455",
  "email": "alice@gmail.com",
  "name": "Alice Johnson",
  "iat": 1739050000,
  "exp": 1739053600
}

This tells the app:

The user is Alice, authenticated by Google, and the token expires in one hour.

⚙️ OIDC Endpoints

⚖️ OAuth 2.0 vs OpenID Connect (OIDC)

🌍 Real-World Examples

✅ Summary