OAuth 2.0 Security Best Current Practice

Re:OAuth 2.0 Security Best Current Practice by anderspitman on Tuesday May 05, 2020 @05:48PM (#23085472)

Forgive me if I'm mistaken, but isn't OIDC for authentication/profile information? Does it include standards for things like accessing contact lists, reading/writing files, sending email, etc?

[ Parent | on HN ]

Re:OAuth 2.0 Security Best Current Practice by niftich on Tuesday May 05, 2020 @06:29PM (#23085881)

OIDC is for authentication and profile information. The standard claims refer to each field of profile information [1].

It doesn't include any domain-specific operations like your examples.

[1] https://openid.net/specs/openid-connect-core-1_0.html#Standa...

[ Parent | on HN ]

Re:OAuth 2.0 Security Best Current Practice by ecnahc515 on Tuesday May 12, 2020 @07:42PM (#23161500)

A bit late: you're correct, but it does provide a standard API for looking up additional metadata, even if it's non-standard. That's using custom claims and/or the user info endpoint (which can include custom claims). You can use custom scopes to limit what is available as well.

[ Parent | on HN ]