OAuth 2.0 Access Token vs. OpenID Connect ID Token

OAuth 2.0 Access Token vs. OpenID Connect ID Token

[mysterygirl]

Hi , The background sound could have been avoided though a good explanation

[dasiths]

You said that the auth server doesn't know about the resource which isn't technically true. Let's take the oauth 2 implicit flow, you can specify the aud and scopes that you want in the request. If the auth server has a consent framework, it will display the appropriate dialog and then return a token (jwt) with iss claim set to the auth server, aud set to the requested audience and scp set to the requested/consented scopes. When you pass this token to the resource server it should validate the iss, aud among other things. Then use the scp claims for authorization concerns. (I'm taking AzureAD as an example). The id_token is always a jwt (openid) but the access token can be opaque. For oauth 2 spec, AzureAD returns an access_token which is also a jwt you can use as a bearer token. The resource server doesn't need to call the auth server to validate the token in this scenario as it can just validate the jwt itself.

[adityagtm]

Background music is disturbing...rest all good 👍

[matzumoto]

Thank u very much, sir. Very good explanation