OAuth 2.0 and OpenID Connect in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is OAuth 2.0?

OAuth 2.0 is a protocol that allows a user to grant limited access to their resources on one site to another site, without sharing their password. It is mainly used for authorization.

beginner

What is OpenID Connect (OIDC)?

OpenID Connect is an identity layer built on top of OAuth 2.0. It allows clients to verify the identity of the user and obtain basic profile information in a secure way.

intermediate

What is the main difference between OAuth 2.0 and OpenID Connect?

OAuth 2.0 is for authorization (granting access to resources), while OpenID Connect adds authentication (verifying who the user is) on top of OAuth 2.0.

beginner

What is an access token in OAuth 2.0?

An access token is a string issued by the authorization server that allows the client to access protected resources on behalf of the user for a limited time.

intermediate

What is an ID token in OpenID Connect?

An ID token is a JSON Web Token (JWT) issued by the OpenID provider that contains information about the user’s identity, such as their unique ID and authentication time.

Which protocol is primarily used for user authentication?

A FTP

B OAuth 2.0

C OpenID Connect

D HTTP

OpenID Connect is designed for authentication, allowing verification of user identity.

What does OAuth 2.0 allow a user to do?

A Verify their identity

B Encrypt their data end-to-end

C Create a new user account

D Grant limited access to their resources without sharing passwords

OAuth 2.0 lets users authorize third parties to access their resources without sharing passwords.

What type of token contains user identity information in OpenID Connect?

A ID token

B Refresh token

C Access token

D Session token

The ID token contains user identity details in OpenID Connect.

Which of these is NOT a role in OAuth 2.0?

A Resource Owner

B Identity Provider

C Authorization Server

D Resource Server

Identity Provider is a role in OpenID Connect, not OAuth 2.0 specifically.

What does the access token allow a client to do?

A Access protected resources

B Change user passwords

C Authenticate the user

D Create new users

Access tokens allow clients to access protected resources on behalf of the user.

Explain how OAuth 2.0 and OpenID Connect work together to provide secure access and identity verification.

Think about how one protocol controls access and the other confirms who the user is.

Describe the purpose of access tokens and ID tokens in OAuth 2.0 and OpenID Connect.

Consider what each token allows the client or server to do.