OpenID Connect (OIDC) is an open authentication protocol that works on top of the OAuth 2.0 framework. Targeted toward consumers, OIDC allows individuals to use single sign-on (SSO) to access relying party sites using OpenID Providers (OPs), such as an email provider or social network, to authenticate their identities. It provides the application or service with information about the user, the context of their authentication, and access to their profile information.
The purpose of OIDC is for users to provide one set of credentials and access multiple sites. Each time users sign on to an application or service using OIDC, they are redirected to their OP, where they authenticate and are then redirected back to the application or service.
OIDC is one of the newest security protocols and was designed to protect browser-based applications, APIs, and mobile native applications. It delegates user authentication to the service provider that hosts the user account and authorizes third-party applications to access the user’s account.
For example, there are currently two ways of creating a Spotify account. You can register with Spotify or you can sign on through Facebook. Facebook sends your name and email address to Spotify, which uses that information to authenticate you.
SSO not only increases employee productivity by reducing the time they must spend signing on and dealing with passwords, but it also improves the customer experience. It’s known that many customers abandon their carts because of forgotten passwords. SSO creates a more seamless experience with less frustration, which results in customer loyalty, higher conversion rates, and enhanced brand visibility.
SSO also significantly decreases the likelihood of a password-related hack. With SSO, users only need to remember a single password for all their applications and are less likely to reuse passwords or write them down, which reduces the risk of theft. Easy access is particularly valuable for employees that are in the field or working from multiple devices.
Using SSO can decrease IT costs by reducing the number of required passwords to just one, and can also be used to strengthen B2B partnerships. Using federated SSO (or federated identity management) can help separate organizations and third parties, such as application vendors or partners, share identities and authenticate users across domains. When two domains are federated, a user can authenticate to one domain and then access resources in the other domain without having to sign on again.
OIDC is similar to OAuth where users give one application permission to access data in another application without having to provide their usernames and passwords. Instead, tokens are used to complete both authentication and authorization processes:
ID tokens cannot be used for API access purposes and access tokens cannot be used for authentication. The following diagram shows how a typical OIDC authentication process works.
The primary difference between these standards is that OAuth, now known as OAuth 2.0, is an authorization framework used to protect specific resources, such as applications or sets of files, while SAML and OIDC are authentication protocols used to create secure sign-on experiences. SAML and OIDC are about who someone is, where OAuth is about what they are allowed to do.
OAuth, now known as OAuth 2.0, is an open standard framework for API authorization. It defines how an API client can obtain security tokens that contain a set of permissions against the resources available through that API.
Instead of requiring a user to share login credentials with one application to give that application access to another, OAuth delegates authorization decisions to a separate authorization server that hosts the user account. Essentially, OAuth acts on behalf of the user, providing delegated access to a third-party service without the user exposing their credentials to that third party.
The primary difference between OpenID Connect and OAuth is that OAuth is an authorization framework used to protect specific resources, such as applications or sets of files, while SAML and OIDC are authentication standards used to create secure sign-on experiences.
SAML and OIDC are both powerful authentication protocols used to create secure sign-on experiences, but are used for different purposes.
Additional differences include:
OIDC is one of the newest security standards available and is used by developers who support mobile applications, APIs, and browser-based applications. Other benefits include:
Since tokens are used to complete the authentication and authorization processes instead of usernames and passwords, developers are no longer responsible for setting, storing, and managing passwords, which is often the cause of credential-based data breaches.
Using tokens makes it a highly secure protocol. Not only are user credentials not shared, but it also makes it possible for users to sign on to multiple applications without having to create separate usernames and passwords for each, which can easily be compromised.
OIDC is an open standard, decentralized authentication protocol that allows websites and authentication services to securely exchange information in a standardized way.
It is easy, reliable, secure, and eliminates storing and managing people’s passwords. It improves the user experience of sign-up and registration and reduces website abandonment. Furthermore, Public-key-encryption-based authentication frameworks like OpenID Connect increase the security of the whole Internet by putting the responsibility for user identity verification in the hands of the most expert service providers.
Developers should use OIDC if they support mobile applications, access to APIs, and browser-based applications.
OpenID Connect has many architectural similarities to OpenID 2.0, and in fact the protocols solve a very similar set of problems. However, OpenID 2.0 used XML and a custom message signature scheme that in practice sometimes proved difficult for developers to get right, with the effect that OpenID 2.0 implementations would sometimes mysteriously refuse to interoperate. OAuth 2.0, the substrate for OpenID Connect, outsources the necessary encryption to the Web’s built-in TLS (also called HTTPS or SSL) infrastructure, which is universally implemented on both client and server platforms. OpenID Connect uses standard JSON Web Token (JWT) data structures when signatures are required. This makes OpenID Connect dramatically easier for developers to implement, and in practice has resulted in much better interoperability.
The primary difference between these standards is that OAuth, now known as OAuth 2.0, is an authorization framework used to protect specific resources, such as applications or sets of files, while OIDC is an authentication protocol used to create secure sign-on experiences. OIDC is about who someone is, where OAuth is about what they are allowed to do when they access the resource.
The FIDO Alliance is one organization in which non-password authentication technologies are being explored. Some OpenID Foundation members are also members of the FIDO Alliance, working on authentication technologies there that can be used by OpenID Providers.
The FIDO Alliance is an open industry association focused on creating authentication standards that “help reduce the world’s over-reliance on passwords.” Some OIDC Foundation members are also members of the FIDO Alliance, who are working on authentication technologies that can be used by OpenID Providers.
OpenID Connect identifies a set of personal attributes that can be exchanged between Identity Providers and the apps that use them and includes an approval step (aka authorization) so that users can consent (or deny) the sharing of this information.
Since tokens are used to authenticate users instead of usernames and passwords, users don’t need to share their credentials with any of the applications they access.
Start Today
See how Ping can help you deliver secure employee and customer experiences in a rapidly evolving digital world.
Request a FREE Demo