What is OAuth and OpenID Connect?
D1 · General · CompTIA Security+ SY0-701OAuth 2.0 is an authorization framework that allows a third-party application to access a user's resources (on another service) without sharing credentials. It grants limited access tokens.
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication — it tells the application who the user is via an ID token (JWT).
Example: "Sign in with Google" uses OIDC for authentication and OAuth for authorization (e.g., accessing your Google Drive).
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication — it tells the application who the user is via an ID token (JWT).
Example: "Sign in with Google" uses OIDC for authentication and OAuth for authorization (e.g., accessing your Google Drive).
OAuth = authorization ("what can this app do?"). OIDC = authentication ("who is this user?"). SAML is older/enterprise XML-based. OAuth/OIDC are modern/API-friendly JSON-based. All three enable SSO/federation.