OAuth2.0 without OIDC (Plain OAuth2.0)

Question

As far as I understand, applications that we can login with our different accounts use OpenID Connect(A profile of OAuth2.0).
OAuth is for Authorization and OIDC is for authentication(It has ID Token-User Info Endpoint).

• So, was it not possible to login to an application from another application account using OAuth before OIDC? (If possible, how?)

• If plain OAuth can't be used for authentication, what is/was it used for?
  I mean what does it do with 'authorization' exactly?
  What does it get from the resource service with the access token?

Answer 1

I have always found the jargon around this unhelpful so I understand your confusion. Here is a plain English summary:

OAuth 2.0

Before OIDC apps used OAuth 2.0 to get tokens, and this involved optional user consent. The process of getting tokens was termed 'delegation'.

In practical terms though all real world OAuth 2.0 providers also included authentication in order for their system to be secure. How authentication was done is not defined in OAuth specifications.

OAuth is primarily about protecting data, where scopes and claims are the mechanisms. These links provide further info:

• IAM Primer
• Scope Best Practices
• Claims Best Practices

OIDC

This just adds some clearer definition around how authentication messages before and after authentication should work:

• A client simply includes an openid scope to use OpenID Connect
• A client may force a login during a redirect via a prompt=login parameter
• A client may request an authentication method via an acr_values parameter
• The client receives an ID token (assertion) once authentication is complete, can digitally verify it if required, then use the information in it (eg a user name)

OIDC still does not define how the actual authentication works though.

Use them together

Pretty much all OAuth secured apps (and libraries) these days use both together, so that the authentication and delegation both use standards based solutions. It gives you the best application features and design patterns for doing the security well.