Hacker News Reader

Great write up. Dealing with my own employer and the constant confusion around oauth vs OIDC vs JWT, and having to explain they aren't VS at all! They are all stacked on oauth itself, and don't really have much to say about the actual authentication of a user (that is just up to the identity provider).

View on HN

True, perhaps worth noting though that in OpenID Connect an RP (website or app) can actually request a specific authentication mechanism using the acr_value (assuming the OP supports multiple authentication mechanisms). This can give the application some input over how people are identified before authorizing access to protected resources.

http://openid.net/specs/openid-connect-core-1_0.html#acrSema...

I think this is one of the great virtues of OAuth/OIDC. It makes you realise that, in most cases, you don't care about identity per se when making access control decisions. We just tend to use it as a proxy to infer attributes...

Reply on news.ycombinator.com