English
Menu

Web Technology Basics

Which of the following correctly describes the relationship between OAuth 2.0 and OpenID Connect?

  1. AOAuth 2.0 is a mechanism for delegating permission to access resources (authorization), and OpenID Connect builds on it by adding an ID token that conveys the result of authentication, so that it can be used for login
  2. BOAuth 2.0 is a mechanism for conveying the result of user authentication, and OpenID Connect does not use it but sends the user's password directly to each connected service to check it
  3. COpenID Connect is a protocol for encrypting HTTP communication and is used instead of TLS when sending login screens
Show answer and explanation

Answer: A. OAuth 2.0 is a mechanism for delegating permission to access resources (authorization), and OpenID Connect builds on it by adding an ID token that conveys the result of authentication, so that it can be used for login

An OAuth 2.0 access token represents permission, meaning "you may use resources within this scope", and is not designed to confirm who has logged in. OpenID Connect adds to the OAuth 2.0 flow an ID token in the form of a signed JWT. The ID token contains the issuer, the user identifier, the intended client, the expiry and so on, and the client checks the signature and contents to learn who the user is. This mechanism is used for features that let users log in with an account from another service and for single sign-on.

  • A. Correct. It adds an ID token that conveys the result of authentication to OAuth 2.0, which is an authorization mechanism.
  • B. The roles are reversed. OAuth 2.0 is an authorization mechanism, and OpenID Connect is built on top of OAuth 2.0.
  • C. Encrypting communication is the role of TLS. OpenID Connect is used over communication protected by TLS.
Practice this topic Back to topic

Books on Web Technology Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Web Technology Basics questions

  1. Which of the following is an appropriate web API design that follows the principles of REST?
  2. A browser opens https://www.example.com:8443/docs/guide.html?lang=ja#install. Which part of this URL is not included in the request sent to the server and is used only inside the browser after the page loads?
  3. To put the Japanese character "あ" into a URL query, the byte sequence representing it in UTF-8 (E3 81 82) is percent-encoded. Which of the following is the correct result?
  4. A chat app needs to deliver new messages from the server to the browser immediately. Which of the following correctly describes WebSocket?
  5. A merchant's server wants to know immediately when a payment is completed on an online payment service. Which of the following correctly describes the method in which the payment service sends a notification by HTTP POST to a URL the merchant registered in advance (a webhook)?