OpenID Connect vs OAuth | OpenID Connect explained

🔥More exclusive content: https://productioncoder.com/you-decid...
Twitter:   / _jgoebel  
Website: https://jangoebel.com
Blog: https://productioncoder.com

00:00 What is OpenID Connect and how does it relate to OAuth?
00:50 OAuth does not provide identity information to the third party application
03:14 A practical OpenID Connect example
04:00 Scopes for OpenID Connect
07:17 OpenID Connect Identity tokens
08:41 Conclusion

This video explains what OpenID Connect (OIDC) is and how it relates to OAuth. OpenID Connect is a thin identity layer on top of OAuth that provides authentication details about end users. OAuth is all about giving third party applications limited access to HTTP resources. To give access to HTTP resources, identity information is not required.

However, for some type of apps, it is actually very useful to know at least a little bit about the user (like the email or profile information). This is where OpenID Connect comes in. During the OAuth flow, the third party application requests the additional openid scope and specific standardizes scopes by OpenID Connect. When the access is granted by the end user, the application not only receives an access token, but also receives an identity token (id token). The id token is a JSON Web Token (JSON Web Signature Token) that contains information about the end user. Third party application can ask for predefined scopes like email or profile information.

The information in the id token from OpenID Connect can then be used to provide a better user experience.