From 009c445c8d98dd8e6d83aa1407ee41c501e2d568 Mon Sep 17 00:00:00 2001 From: Lars Wirzenius Date: Sat, 25 Apr 2020 10:27:45 +0300 Subject: Drop: HTML --- yuck.html | 67 --------------------------------------------------------------- 1 file changed, 67 deletions(-) delete mode 100644 yuck.html diff --git a/yuck.html b/yuck.html deleted file mode 100644 index 6074c8f..0000000 --- a/yuck.html +++ /dev/null @@ -1,67 +0,0 @@ - - - - - - - Yuck or OIDC - - - -

Yuck or OIDC

2020-04-25 10:16

- -

1 Overview

1.1 Concepts

Some basic concepts in this document:

identity: data about who you are to tell you apart from everyone else
authentication: proving your identity
authorization: giving permission to do something

1.2 The protocols: OAuth 2.0 and OpenID Connect

The OAuth 2.0 protocol is for authorization, not authentication, and assumes an already existing way to authenticate users. It’s mainly for giving a service or application permission to do something on your behalf.

The OpenID Connect (OIDC) protocol is for authenticating yourself to one service or application by using a third party service. This allows one authentication service (or identity provider) be used for any number of other services or applications. Further, since the identity provider can keep a login session open independently of the other services and applications, this provides a single sign-on experience.

1.3 Entities involved in the protocols

The protocols involves the following entities:

the end user, who is trying to do something; also the resource owner
the web browser, used by the user; might be a mobile or command line application instead of a browser per se
the application, which the user uses to do things, and as part of that access resources
the resource provider, where the resources are, and which allows access to them via a web API
the identity provider (IDP), which authenticates the user

2 OIDC protocol

This augments the plain OIDC with cookies:

an app cookie set by the application to tie a user and their session together: this lets the application store data about the user and what they’re doing between HTTP requests
a login cookie set by the IDP to remember this user has a valid login session

2.1 Successful resource access by a logged-out user

2.2 Successful resource access by a logged-in user

- -

- - -- cgit v1.2.1