OpenID and Authentication and OpenID Connect
4 slides · 2 min read · Domain 5
OpenID and Authentication and OpenD Connect
Two more modern protocols are commonly used together to provide authentication services.
They are Auth 2.0 and OpenID Connect, which offer a related but competing approach to SAML.
OpenID Connect is an implementation of the authorization framework Auth 2.0, facilitating the communication of attribute and authentication information.
Whereas SAML specifically relays requests from a website, OpenD Connect can work to effect authentication with either a website or mobile application as the requester.
An OpenD Connect (OIDC) authentication sequence requires the selection of an OpenlD identity provider (ldP). Once the IdP is known, OIDC operates as an authentication layer on top of the Auth 2.0 protocol, allowing the Relying Party to request and receive information about the user from the IdP.
OAuth 2.0 is itself an authorization protocol. Using it, a client application can request access to a protected resource from the entity that owns that resource.
The request goes to an authorization server, which must authenticate the owner, validate the request, obtain authorization from the owner, and then relay a token to the resource server that hosts the protected resource.
In the OIDC authentication implementation, the Relying Party (RP) is an OAuth 2.0 application requesting an ID token from an OpenlD Connect Provider (OP). The fields in the token will contain data ("claims") about both the user (called the subject, or sub, and known by a locally unique identifier) and the timing (both the "issued at" time, or "iat," and the expiration time, "exp") of the authentication event. Also, the ID token will contain the issuer identifier (iss) of the OP and the client identifier (audience, or aud) registered for the RP at the issuer. Additionally, the claims can contain more information about the user, such as first.
name, last-name, and so on.
One way to view this extension of Auth 2.0 is that OpenID Connect effectively allows an application to request authorization to authenticate a user.