Comment by mrweasel

8 months ago

My understand is that OpenID Connect is build on top of OAuth2, sort of a specialization.

8 comments

mrweasel

Reply
jcmfernandes  8 months ago

Correct. OAuth is for delegated authorization. OpenID Connect for authentication.

  • mooreds  8 months ago

    > OAuth is for delegated authorization.

    Have you ever seen OAuth used alone? I'm looking for examples of this and they seem to be few and far between.

    • jcmfernandes  8 months ago

      There are LOTS of them. Anything that allows you to link your Google/Facebook/etc. account to another system, so that system can perform actions on your Google/Facebook/etc. account on your behalf.

      Examples: Slack (e.g., notify you of events on your calendar, create a GMeets meeting), services like cal.com, whatsapp (store backups on your Google Drive).

    • hirsin  8 months ago

      It's rare in my experience. We don't support OIDC, so technically it's standalone oauth. In reality there's of course a user identity in the mix used to authorize the resulting access tokens.

      Even server to server calls, ie daemons, service principals, what have you, still rely on a client identity.

      I think the closest to true agentless access I've seen widely used are SAS for Azure Storage and of course deploy keys in GitHub, which we're building off ramps for. Agentless authz just is not a good idea