OpenID vs. OAuth

Question

Possible Duplicate:
What's the difference between OpenID and OAuth?

What is really the difference between OpenID and oAuth? They look just the same to me.

I should clarify, I'm planning to use them in drupal, if that makes any difference. So I guess I'm bound by whatever module implementations are available in drupal.

score 246 · Answer 1 · answered Jul 30 '10 at 23:57

246

OpenID is a way to specify one identity for multiple sites so you don't need to register over and over again.

OAuth is a way to allow one application access to one account without giving said application your account login information. You can use them in conjunction.

More info: OAuth-OpenID: You’re Barking Up the Wrong Tree if you Think They’re the Same Thing

answered Jul 30 '10 at 23:57

29

i like this response more than the one marked as the answer. anybody else? – Randy L Nov 30 '10 at 02:47
Due to vote count difference Mark got a nice badge for it. That's for sure. :) – Robert Koritnik May 15 '11 at 07:44
@Mark: So it is now. I upvoted accepted one up (and yours as well). Should be a badge now. – Robert Koritnik May 16 '11 at 10:41
Me too, I upvoted you, I think this is a really good summary – Dorian Jul 03 '11 at 08:51
its ok people find the top rated answer anyway! – HaveAGuess Jan 29 '12 at 01:04
2

The [About from the official OAuth](http://oauth.net/about/) site is very helpful. Didn't think it was worthy of another answer, but definitely a nice mention. – mateuscb Jun 12 '12 at 00:42

Dorian · Accepted Answer · 2014-04-16T13:00:45.723

107

If you have an account (with some private resources) in a website, you can log in with username/password couple. If an application would like to get some private resources, and if you don't want to give them your username/password, use OAuth.

But if you want to log in into multiple websites with a unique account, use OpenID.

(Some websites use OAuth like OpenID, and OpenID can be use like OAuth if you have some private stuff in your OpenID account)

edited Apr 16 '14 at 13:00

answered Jul 31 '10 at 00:00

Dorian

19,009
8
108
111

7

Just comprised all the information got. Hope this [OpenID & OAuth](http://techastute.blogspot.com/2012/05/openid-authentication-oauth.html) is useful. – raksja May 21 '12 at 20:20

score 78 · Answer 3 · answered Jul 31 '10 at 00:03

78

OpenID = using login credentials from an OpenID provider (Google) to login to another application (Stack Overflow)

OAuth = Allowing an application (TwitPic) to act on your behalf to and access information from an application that you use (Twitter).

They can be used in conjunction with each other.

answered Jul 31 '10 at 00:03

gmoore

5,396
4
26
35

Is'nt that the case that Stack Overflow or other websites that belong to stackoverflow like serverfault use OAuth for new user signup using google or facebook and OpenID for signup using other website of their domain like serverfault or askubuntu. In OAuth we can restrict what information is flowing from authentication party(facebook) to service provider(stackoverflow). In OpenID we simply give a certificate symbolizing the person as legal and give access to whole database. Since stackoverflow or askubuntu belong to same domain they can exchange certificates with full access to user databases. – Revanth Kumar May 05 '15 at 23:06

score 20 · Answer 4 · answered Jul 31 '10 at 00:03

OpenID is purely* for multi-site authentication with a single set of credentials.

OAuth is for letting applications access each other securely: data sharing. Think of it as setting a bond of trust between two things, eg allowing your flickr account to post things on your facebook wall or hooking your flickr photos into a third-party printing website.

OAuth isn't just about site-to-site. You can link in desktop applications with no real concept of "identity" to an identity-driven site like Facebook or twitter (eg a twitter client being able to post to your feed without having to store your login details).

There are similarities but OAuth is really all about the service-to-service links.

score 20 · Answer 5 · answered Jan 29 '12 at 09:29

20

OpenID is about authentication to many sites with one username.
OAuth is about authorization - site A has permission to call site B's api.

Here's another good article/analogy explaining the differences: http://www.dotnetopenauth.net/about/about-oauth/

answered Jan 29 '12 at 09:29

Landon Poch

832
1
8
17

2

`site A has permission to call site B's api.` That cleared it for me. Thanks a ton. – bad_keypoints Aug 17 '13 at 08:37
Also, if I want users visiting my site to signup for my website by signing into Google, then storing a hash of their email ID against all their activities for accounting reasons, I'd be using... OpenID, right? – bad_keypoints Aug 17 '13 at 08:39
@ronnieaka OpenID would work just fine for that. – Landon Poch Aug 19 '13 at 22:49
alrighty. thanks! this was a big doubt. – bad_keypoints Aug 20 '13 at 03:09

OpenID vs. OAuth

5 Answers5

Linked