OAuth OIDC Concepts and when to use what

A progressive, enterprise-grade learning path — the kind that builds depth layer by layer: from OAuth fundamentals → PKCE → OIDC → SAML → enterprise use-case integration.

LEVEL 1 — Core Concept: What OAuth 2.0 Really Does

Goal: Understand that OAuth is authorization, not authentication.

The Problem It Solves

Users don't want to hand out their passwords to every app that needs data from another system (Google Photos, Salesforce, etc.). OAuth lets users delegate limited access safely.

Key Roles in Every OAuth 2.0 Transaction

Core Principle

The client never sees the user's password — only a token representing delegated permission.

Real Enterprise Example

A third-party payroll app integrates with Workday's API.Workday acts as the Authorization + Resource Server, issuing access tokens so the payroll app can read employee data without ever seeing Workday credentials.

LEVEL 2 — OAuth 2.0 Grant Types (Flows)

Each "grant" = a pattern for how the client gets the token.

LEVEL 3 — PKCE: Securing the Authorization Code Flow

Problem PKCE fixes:Public clients (mobile/SPAs) can't store a client_secret. If an attacker steals the authorization code from the redirect URL, they could redeem it for tokens.

PKCE (RFC 7636) adds a one-time proof of possession step:

1. App creates random code_verifier → hashes it → code_challenge.
2. App sends code_challenge in the initial redirect.
3. Authorization Server stores it.
4. Later, app redeems the code using its original code_verifier.
5. Server hashes it again → compares → issues token only if it matches.

Because SHA-256 is one-way, interception of the challenge is useless.

Enterprise Example:Hilton's mobile check-in app → redirects users to login.hilton.com.Even if a malicious Wi-Fi hotspot sniffs the redirect URL, it cannot replay the authorization code because it lacks the code_verifier.

LEVEL 4 — OpenID Connect (OIDC): Adding Authentication on Top

OAuth 2.0 = "Can app X access resource Y?"OIDC = "Who is this user?"

OIDC reuses the OAuth flows but adds the ID Token (a JWT signed by the Identity Provider).

Extra Players

How It Extends OAuth

1. Client requests both openid scope and usual OAuth scopes.
2. After user login, OP issues:
3. • Access Token → for API calls
   • ID Token → contains identity claims (sub, email, name, etc.)
4. Client validates the ID Token's signature and logs the user in.

Enterprise Use Case:Employee signs in to multiple SaaS tools via Azure AD.Azure AD (OP) issues ID Tokens → each SaaS app (RP) trusts them → seamless SSO.

LEVEL 5 — SAML 2.0: The Older Enterprise Workhorse

SAML (Security Assertion Markup Language) predates OIDC.It's XML-based and used heavily in classic enterprise SSO with on-prem IdPs.

Flow Summary

1. User tries to access a Service Provider (SP) — e.g., salesforce.com.
2. SP redirects to Identity Provider (IdP) — e.g., Okta, AD FS.
3. User authenticates.
4. IdP sends back a SAML Assertion (an XML doc) to the SP.
5. SP validates the signature (using IdP's public key) → user logged in.

Comparison: OIDC vs SAML

Enterprise Pattern

• SAML for older SaaS like Workday, Salesforce Classic.
• OIDC for modern microservices and SPAs.Most large orgs run both via an IdP that supports protocol bridging (Okta, Ping, Azure AD).

LEVEL 6 — Tying It All Together in an Enterprise Architecture

1. Identity Federation Hub

Use a central Identity Provider (IdP) such as Okta or Azure AD.

• Supports both SAML and OIDC.
• Acts as the Authorization Server for OAuth 2.0 flows.
• Issues both Access and ID Tokens.

2. Application Types

3. Typical Enterprise Use Cases

LEVEL 7 — Enterprise Security Considerations

1. Use PKCE for every public client — mandatory in OAuth 2.1.
2. Always use HTTPS for all endpoints.
3. Validate redirect URIs to prevent code-injection attacks.
4. Use short-lived Access Tokens + Refresh Tokens with rotation.
5. Centralize token issuance at the IdP (Azure AD, Okta, Ping).
6. Log every token issuance and validation for compliance (PCI/SOC2).
7. Adopt Zero Trust: every API call re-authenticates via token validation.

LEVEL 8 — Visual Mental Model (Quick Recap)

User (Resource Owner)
   ↓ login/consent
Authorization Server (IdP) ── issues tokens ──► Client App
   │                                        │
   │ access token verifies identity          │
   ▼                                         ▼
Resource Server (API)  ◄───── token ───────  Client (Web/Mobile)

Add OIDC → you also get an ID Token for login.Add PKCE → you protect the Authorization Code from replay.Use SAML → same goal, older XML protocol.

LEVEL 9 — When to Use What