Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I actually find it very readable. It was at least readable enough so I could implement an OAuth2 client from scratch in C# as a student.

However after years I still don't understand the technical differences between OpenID Connect and OAuth2. Can a OAuth2 client connect to a OpenID Connect server?



OpenID Connect is an extension to OAuth2 and a strict superset of it. All OpenID Connect servers are OAuth2 authorization servers - but not the inverse.

OAuth2 technically only offers "authorization" (granting access to do something), but OpenID Connect adds an "authentication" (who is getting this access?) layer on top of OAuth2 by returning an id_token alongside the authorization_token.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: