更多的是对问题的延伸而不是答案，但它可能会为上面伟大的技术答案增加一些视角。我是一个在很多领域都很有经验的程序员，但是在网页编程方面完全是个新手。现在尝试使用Zend框架构建一个基于web的应用程序。

Definitely will implement an application-specific basic username/password authentication interface, but recognize that for a growing number of users the thought of yet another username and password is a deterrent. While not exactly social networking, I know that a very large percentage of the application's potential users already have facebook or twitter accounts. The application doesn't really want or need to access information about the user's account from those sites, it just wants to offer the convenience of not requiring the user to set up new account credentials if they don't want to. From a functionality point of view, that would seem a poster child for OpenID. But it seems that neither facebook nor twitter are OpenID providers as such, though they do support OAuth authentication to access their user's data.

在我读过的所有关于这两者及其区别的文章中，直到我看到上面Karl Anderson的观察，“OAuth可以用于身份验证，这可以被认为是一种无操作授权”，我才看到任何明确的确认OAuth足以满足我想要做的事情。

In fact, when I went to post this "answer", not being a member at the time, I looked long and hard at the bottom of this page at the options for identifying myself. The option for using an OpenID login or obtaining one if I didn't have one, but nothing about twitter or facebook, seemed to suggest that OAuth wasn't adequate for the job. But then I opened another window and looked for the general signup process for stackoverflow - and lo and behold there's a slew of 3rd-party authentication options including facebook and twitter. In the end I decided to use my google id (which is an OpenID) for exactly the reason that I didn't want to grant stackoverflow access to my friends list and anything else facebook likes to share about its users - but at least it's a proof point that OAuth is adequate for the use I had in mind.

It would really be great if someone could either post info or pointers to info about supporting this kind of multiple 3rd-part authorization setup, and how you deal with users that revoke authorization or lose access to their 3rd party site. I also get the impression that my username here identifies a unique stackoverflow account that I could access with basic authentication if I wanted to set it up, and also access this same account through other 3rd-party authenticators (e.g. so that I would be considered logged in to stackoverflow if I was logged in to any of google, facebook, or twitter...). Since this site is doing it, somebody here probably has some pretty good insight on the subject. :-)

很抱歉这篇文章写了这么长时间，而且更多的是一个问题而不是一个答案——但是Karl的评论似乎是在OAuth和OpenID上大量的帖子中最合适的地方。如果我没有找到更好的地方，我提前道歉，我确实试过了。

在阅读和做了一些工作后，我认为我需要知道的事情是:OpenID Connect, OAuth, JWT和SAML。

我来总结一下，可能会对大家有所帮助:

OpenID连接(OIDC):如果我们可以使用谷歌帐户登录一个网站，那么您使用的是OIDC。

OAuth:一个应用程序想要访问我的facebook联系人列表，并代表我做一些事情。如果我授权这个应用程序，那么我可能正在使用OAuth。

JWT: OAuth使用JWT, JWT (JSON Web令牌)-它只是一种令牌格式。JWT令牌是JSON编码的数据结构，包含有关发行者、主题(索赔)、到期时间等信息。对它进行签名以防止篡改和真实性，并且可以使用对称或非对称方法对它进行加密以保护令牌信息。JWT比SAML 1.1/2.0更简单，所有设备都支持它，而且它比SWT(简单Web令牌)更强大。

OAuth中的授权流程:

OAuth 2.0协议为授权用户和获取访问令牌提供了几个工作流。这取决于客户端的类型和体系结构，哪个流是最合适的。

下面是2个最常用的授权流程:

授权码:适用于包含客户端和服务器组件的第三方网站。

用户向安全登录网页输入凭据。 登录后，浏览器被重定向到一个特殊的URL(由客户端定义)，并在URL中传递一个授权代码。 第三方服务器使用授权代码在后台通过另一个HTTP请求获取访问令牌。 从https://developers.video.ibm.com/api-basics-authentication/

注意:如果你有一个前端应用程序，服务器在浏览器中设置了cookie，那么你的浏览器中已经有了cookie，可以访问该网站。

客户端凭证:开发服务器端应用程序以管理其内容或设置的用户的最佳选择。

IBM有一个很好的指南:https://developers.video.ibm.com/api-basics-authentication 要了解所有其他流的优点和缺点:这里:https://www.geeksforgeeks.org/workflow-of-oauth-2-0/

SAML:也用作openid的替代品，但它是基于xml的。因为开发人员发现OIDC更容易使用，而且它更灵活(例如，与基于xml的SAML相比，与移动应用程序一起使用更容易)，OIDC看起来将成为赢家。

OpenID连接(OIDC)与SAML:主要区别:

SAML transmits user data in XML format. OIDC transmits user data in JSON format. SAML calls the user data it sends a SAML Assertion. OIDC calls the data Claims. SAML calls the application or system the user is trying to get into the Service Provider. OIDC calls it the Relying Party. SAML is old, has more features, but OpenID is gaining more popularity as it is easier to implement, easier to use than XML based SAML But not all identity providers support OpenID or SAML, if the identity provider you want to integrate only supports SAML, then you have no choice.

想要更多OpenID vs SAML?读下面: https://www.onelogin.com/blog/real-difference-saml-oidc https://auth0.com/intro-to-iam/saml-vs-openid-connect-oidc/

想要更多吗?你可以读一下OAuth和OpenID的类比: http://cakebaker.42dh.com/2008/04/01/openid-versus-oauth-from-the-users-perspective/

OpenID是由OpenID基金会控制的一个开放标准和分散的身份验证协议。 OAuth是访问授权的开放标准。 OpenID连接(OIDC)结合了OpenID和OAuth的特性，即同时进行身份验证和授权。

OpenID采用由某个“OpenID提供者”即身份提供者(idP)管理的唯一URI的形式。

OAuth可以与XACML结合使用，其中OAuth用于所有权同意和访问委托，而XACML用于定义授权策略。

OIDC使用简单的JSON Web令牌(JWT)，您可以使用符合OAuth 2.0规范的流来获得它。OAuth与OIDC直接相关，因为OIDC是建立在OAuth 2.0之上的身份验证层。

例如，如果您选择使用谷歌帐户登录到Auth0，那么您使用的是OIDC。一旦您成功地使用谷歌进行身份验证并授权Auth0访问您的信息，谷歌将向Auth0发送有关用户和所执行的身份验证的信息。该信息以JSON Web令牌(JWT)的形式返回。您将收到一个访问令牌，如果需要，还会收到一个ID令牌。令牌类型:源:OpenID连接

类比: 一个组织使用ID卡作为识别目的，它包含芯片，它存储关于员工的详细信息以及授权，即校园/大门/ODC访问。ID卡作为OIDC，芯片作为OAuth。更多的例子和形式wiki

有三种方法可以比较OAuth和OpenID:

1. 目的

OpenID是为联邦身份验证而创建的，也就是说，允许第三方使用用户已经拥有的帐户为您验证用户身份。联合这个术语在这里非常重要，因为OpenID的全部意义在于可以使用任何提供者(白名单除外)。你不需要预先选择或与提供商协商协议，以允许用户使用他们拥有的任何其他帐户。

OAuth的创建是为了消除用户与第三方应用程序共享密码的需要。它实际上是作为解决OpenID问题的一种方式开始的:如果您在站点上支持OpenID，则不能使用HTTP基本凭据(用户名和密码)来提供API，因为用户在站点上没有密码。

The problem is with this separation of OpenID for authentication and OAuth for authorization is that both protocols can accomplish many of the same things. They each provide a different set of features which are desired by different implementations but essentially, they are pretty interchangeable. At their core, both protocols are an assertion verification method (OpenID is limited to the 'this is who I am' assertion, while OAuth provides an 'access token' that can be exchanged for any supported assertion via an API).

2. 特性

这两种协议都为站点提供了一种方法，可以将用户重定向到其他地方，然后返回一个可验证的断言。OpenID提供身份断言，而OAuth以访问令牌的形式更为通用，可用于“向OAuth提供者询问问题”。但是，它们各自支持不同的特性:

OpenID - the most important feature of OpenID is its discovery process. OpenID does not require hard coding each the providers you want to use ahead of time. Using discovery, the user can choose any third-party provider they want to authenticate. This discovery feature has also caused most of OpenID's problems because the way it is implemented is by using HTTP URIs as identifiers which most web users just don't get. Other features OpenID has is its support for ad-hoc client registration using a DH exchange, immediate mode for optimized end-user experience, and a way to verify assertions without making another round-trip to the provider.

OAuth - the most important feature of OAuth is the access token which provides a long lasting method of making additional requests. Unlike OpenID, OAuth does not end with authentication but provides an access token to gain access to additional resources provided by the same third-party service. However, since OAuth does not support discovery, it requires pre-selecting and hard-coding the providers you decide to use. A user visiting your site cannot use any identifier, only those pre-selected by you. Also, OAuth does not have a concept of identity so using it for login means either adding a custom parameter (as done by Twitter) or making another API call to get the currently "logged in" user.

3.技术的实现

这两种协议在使用重定向获取用户授权方面具有共同的架构。在OAuth中，用户授权访问他们受保护的资源，在OpenID中，用户授权访问他们的身份。但这就是他们所有的共同点。

每个协议都有不同的方法来计算用于验证请求或响应的真实性的签名，并且每个协议都有不同的注册要求。

创建这两个协议的原因不同。创建OAuth是为了授权第三方访问资源。创建OpenID是为了执行分散的身份验证。本网站说明如下:

OAuth是一种用于验证终端用户身份并向第三方授予权限的协议。这个验证的结果是一个令牌。第三方可以使用这个令牌来代表用户访问资源。令牌有一个作用域。作用域用于验证用户是否可以访问某个资源

OpenID是用于分散身份验证的协议。认证是关于身份的;确定用户实际上就是他所声称的那个人。去中心化意味着该服务不知道需要保护的任何资源或应用程序的存在。这就是OAuth和OpenID之间的关键区别。

很多人仍然访问这个网站，这里有一个非常简单的图表来解释它

礼貌维基百科