Re:SAML: A Fractal of Bad Design
by CodesInChaos on Tuesday September 22, 2026 @07:21PM
(#49809641)
OpenID Connect is OAuth2 extended to cover a similar feature set as OpenID.
Yeah I’m so old, I remember when LiveJournal (probably when bradfitz was still involved) were among the first to support original OpenID.
There is nothing left from the OpenID 1.0 and 2.0 protocol in OpenID Connect, except for the core features (identity federation, identity information encoding and updates).
OpenID Connect is basically OpenID reimagined on top of OAuth 2.0, with using JWT for the identity data.
The core OpenID Connect spec is still purely a federated identity standard. There are many other standards pushed by the OpenID foundation, but OpenID Connect itself was never meant to be anything more. The main feature differentiator from the OG OpenID is that it's built on top of OAuth, so you can add other features supported by OAuth (like authorization) ad-hoc.
From vague memory, the other stuff in OpenID Connect was layered over the original OpenID identity verification part.