views:

248

answers:

4
+5  Q: 

OpenID vs. OAuth

What is really the difference between OpenID and oAuth? They look just the same to me.

I should clarify, I'm planning to use them in drupal, if that makes any difference. So I guess I'm bound by whatever module implementations are available in drupal.

+7  A: 

OpenID is a way to specify one identity for multiple sites so you don't need to register over and over again.

OAuth is a way to allow one application access to one account without giving said application your account login information. You can use them in conjunction.

More info: OAuth-OpenID: You’re Barking Up the Wrong Tree if you Think They’re the Same Thing

Mark Trapp
+5  A: 

If you have an account (with some privates ressources) in a website, you can login with username/password couple. If an application would like get some privates ressources, and if you don't want to give them your username/password, use OAuth.

But if you want to login in multiple websites with unique account, use OpenID.

(Some websites use OAuth like OpenID, and OpenID can be use like OAuth if you have some privates stuff in your OpenID account)

Edit : It seems to be a recurent question.

Dorian
+3  A: 

OpenID is purely* for multi-site authentication with a single set of credentials.

OAuth is for letting applications access each other securely: data sharing. Think of it as setting a bond of trust between two things, eg allowing your flickr account to post things on your facebook wall or hooking your flickr photos into a third-party printing website.

OAuth isn't just about site-to-site. You can link in desktop applications with no real concept of "identity" to an identity-driven site like Facebook or twitter (eg a twitter client being able to post to your feed without having to store your login details).

There are similarities but OAuth is really all about the service-to-service links.

Oli
+5  A: 

OpenID = using login credentials from an OpenID provider (Google) to login to another application (Stack Overflow)

OAuth = Allowing an application (TwitPic) to act on your behalf to and access information from an application that you use (Twitter).

They can be used in conjunction with each other.

gmoore