Understanding OAuth2 and OIDC
OAuth2 and OIDC are two important frameworks – the former for authorization and the latter for authentication. However, before explaining them, we must understand the concepts and differences between entity and identity and the difference between authentication and authorization. So, let’s start by demystifying entity and identity.
Clarifying entity and identity
Let’s understand entity and identity, two frequently misunderstood and misused terms.
An entity is any object, such as a user, a device, or an application, that can be represented and referenced in a security context. Essentially, it refers to something that exists and interacts with the system.
Identity is the attributes that uniquely identify an entity within a specific context. These attributes can be credentials, such as a username and password, or tokens that represent the entity within a system.
The following table presents a comparison of the two terms...
