I was dumbly sweating off for 2 days trying to get user information from an "access token" but then I saw this video. The clear difference you explained makes so much sense. Thank you for developing this content, auth0.

@szilardfineascovasa6144

Ай бұрын

Don't feel bad; big companies actually did their "custom hacking" of these before OpenID Connect to make them "fit into" this role as well.

Great video! I especially enjoyed the illustrations created!

the differences were explained very nicely!

Thanks James. Great content as usual. I am a big fan.

@OktaDev

Жыл бұрын

Glad you enjoy it!

You have made it to the point! This is an amazingly easly understandable content in the bushes of misinformation on the internet on that subject! You are explaing here much more than just a difference between the tokens! Well done!

Super informative and concise. Excellent! MM

Great video. Very clear. Thank you!

wow that was a super delicious explanation!! Loved it!!

Thanks James! You rock.

That was very nicely explained. Thank you!

Great video compact and informative

Thanks for a simple and clear explaination

Thank you James! I have some questions What is the use case to have a decentralized authentication or is it preferable ? And for the OAuth protocol I think the use case for the apps that allows integrations and exposes the API to the public ? Or the use case can be suitable for a single app that have micro-services, and multiple clients like web, mobile apps ?

Nicely presented, thank you

This video is a gem. Thank you so much! 💎

Great explaination. Saved

Fantastic video. Very thorough and at the same time concise.

@OktaDev

9 ай бұрын

Great to hear, thanks for the feedback!

Nice one 🎉 informative and helpful 👍

Awesome content!! Thanks a lot 🙌🏾❤

@OktaDev 1:42 "JAWT" is a shortened form of "JAson Web Token"

@user-zz6fk8bc8u

11 ай бұрын

"JAWT" and "JOT" are only spoken. It's just the way some people pronounce "JWT" because "jay-double-you-tea" is pretty long.

Great explanation, thank you

@OktaDev

Жыл бұрын

You are welcome! James is great at explaining things!

Awesome, Thank you so much boss

I have a dumb question. If an access token provides authorization but not authentication, how in the example does Twitter know what user they are posting as? Seems that there MUST be at least an implicit authentication here?

@jano.5485

3 күн бұрын

Bro that is the thing I don't get as well... found an answer that makes sense and you want to share?

thanks man

Well explained. Thank you

Awesome video

Nice explanation 🙂 Thanks for the video 🙂

Thank you.

@OktaDev

Жыл бұрын

You got it!

Great explanation on the difference between access and id tokens. I have a question about access tokens in Auth0 (since as of now there is no agreed upon specification) How does the api receiving the access token know who the requester is (username/email)? The access token proves the user is authorized to request a resource, but has no information who the user is. So how could a remote api determine someones identity information without using the identity token?

@Daniel-zl7wf

Жыл бұрын

Attempting to answer my own question after some research: "The access token is not intended to carry the user data (except for ID passed as the sub claim)" So the remote api can use the "sub" field in the access token to query user data from auth0 such as email.

@codewithray

Жыл бұрын

@@Daniel-zl7wf Thanks bro. Very Informative 🙌

@randomhandle307

Жыл бұрын

I've had the same question.

@Daniel-zl7wf

Жыл бұрын

@@randomhandle307 What I've ended up using the sub field id within my own database as a userId. Not sure if this is the best way.

@vivekagrawal5608

9 ай бұрын

I don't know about Facebook or Google. However, in my org, we are using access token to get the clientId, scope and user info as well. Its called 3LO token.

Can we send Id token to backend for getting the user's data? Note: Sending acces token for api authorisation as well

You are just awesome ❤

Great video.

Nice video. Appreciated. Can we use both in the payment gateway integration

i am very confused the role of id_token, after the application request to authentication server, the server will return id_token, access_token。in my opinion, application request the backend api will pass id_token to backend sever, and backend will use id_token to judge the user is logged? but according the video, id_token is not passed to api. so id_token returned only tell the application the user is logged a moment? id_token will no any effect when api calling？

Finally I understand ID token and Access token. Thank you so much sir!

Thanks for the awesome video!, but I have a question, what if the APIs are like a BFF (APIs that are tied specifically to your web/app)?, in that case can be "good" to use the ID token as a Bearer?. If we need to just sent the access token, how can we use custom attributes (or validate custom permissions) if the information is not available in the token itself without continuously fetching and validating the data?. Thanks!

@liferajib

4 ай бұрын

@Alejandrombc did you get an response ? We are in same boat

Thank you

well explained - thx!

@OktaDev

2 ай бұрын

thanks for watching!

If id token is for bring user info in payload, why does it need to be JWT? What situation I would validate signature if it came from a redirect from IdP?

I love this video. Very well made, the music and the animations are a great match. I think I know a few people that have or are using access tokens as a form of ID. This is a nuance that I only became aware after watching this video, so I definitely learned something new here. Thanks for making this video!

JWT is for Authorization

Great explanation! However, I have a query here. In an enterprise app, the user is authenticated at the frontend app (built in react, angular, etc.) and have the access to ID token, which would be user for future authentication. Now the frontend app needs to access protected RESTful API endpoint. So, authorization will be implemented using the same Identity server (which will act as Authorization Server)? So, for an enterprise app, authentication and authorization can be done using same Identity Server?

@andrea.chiarelli-okta

7 ай бұрын

Assuming that the Identity provider (IdP) uses OpenID Connect, the answer is yes. OpenID Connect is built on top of OAuth 2.0, so the same server is both an Identity provider and an authorization server. Your frontend app can request both an ID token and an access token

@matthayden1979

7 ай бұрын

@@andrea.chiarelli-okta So, what if OIDC is not used for authentication? Some other protocol/framework being used?

@andrea.chiarelli-okta

7 ай бұрын

@@matthayden1979 SAML is another protocol. It relies on exchanging XML documents (SAML Assertions) instead of tokens

I love you, man

If you send an access_token to the API how the API knows that it is allowed to do something on behalf of Jone Doe? There is nothing related to John Doe in the token itself

@johnmathew3423

5 ай бұрын

Please try on behalf flow

tokens are something i used at chucky cheese when i was a kid to play games. what does a token have to do with a computer or the internet? lots of people out there do not like 2fa.

If the access token shouldn’t be sent to my API from my front end, how can my backend know that the user is logged in? Sure, the frontend knows but if it can’t ever convey that information to the backend when making requests, what is it good for? I’m probably missing something obvious but I’m honestly confused.

@andrea.chiarelli-okta

Жыл бұрын

I assume you mean the ID token, not the access token. Your ID token should not be used to tell your backend that the user is logged in (i.e., to create sessions). It's just a confirmation to your frontend app from the authorization server that the user has been authenticated. Your application is responsible for creating its own session using the appropriate technique. For example, in a Web application, you can rely on traditional cookies to create sessions. In a mobile application, you can use session tokens. ID tokens don't replace the way you create and manage your own sessions I hope this clarifies

@FolkOverplay

Жыл бұрын

@@andrea.chiarelli-okta thank you for your reply. Yes I did mean the ID Token. I think I probably need to read up more on this. I fail to see the benefit an ID Token offer except displaying email, name, etc. in the frontend if I can’t send it to my backend. Is this understanding correct? I currently store the ID token in memory only and not in local storage or cookie (Web App). I do send it to my backend. Is this completely wrong?

@OktaDev

Жыл бұрын

Thanks for your reply, Andrea! :)

Awesome. Thumbs up of course. I am just curious if there is a tool that I can use to decode an ID token in code, preferably a command line utility like jq but for ID tokens?

@OktaDev

4 ай бұрын

We'd recommend checking out github.com/jwt-rs/jwt-ui You can encode and decode JWT ID tokens and access tokens using JWT UI on the CLI. Hope that helps!

So if I create a token which a user can use to access resources using API calls in my application after he/she registers/logs-in herself, would that be an id token or an access token or a combination of both?

@OktaDev

19 күн бұрын

If you are using OpenID Connect to authenticate your users, you must use an access token to call the API. If you are not using OpenID Connect or OAuth, and you are creating your own token, the meaning and the purpose of the token is up to you. Hope that helps!

❤

Just because an access token doesn't guarantee that a user is logged in does not, at all, seem to mean that we can't presume the user is authentic. They certainly did make authenticity clear in granting the resource access, so it does absolutely seem to be an authentication token. The only things that make it an authorization token, is if scopes are stored (and checked) associated with that token on the resource server. However, it's certainly also a claim of authenticity if it contains authentic claims for authorization. 😑🤨🤔

Nice, One question - Can we add new claim to access token after logged in?

@mraible

10 ай бұрын

No. The only time you can enrich an access token is upon login. However, you can add an API with a token lifetime of 30 seconds. Then, pass in `offline_access` as a scope, and you should get a new access token (with updates from actions, and therefore enriched) every 30 seconds. This depends on your SDK. It works with the Okta Spring Boot starter.

If ID tokens(JWT) should never be sent to an API, then how the hell a client can be authenticated ? Why Spring Boot has inbuilt methods and structure for signing and validating JWT if we are not going to sent JWTs to Spring Boot API ? Am I wrong or everywhere I read (Stackoverflow, tutorials , etc..) it said exactly the opposite of your statement ?

@mraible

11 ай бұрын

The tokens that Spring Boot validates are access tokens, not ID tokens. If you try to send an ID token to a Spring Boot backend, it won't work. Spring Boot also supports validating opaque access tokens (that are not JWTs) via the introspection endpoint.

Hello, how are you, there are applications that request a token, request that the client id and seceret key be sent, others an api token and a secret key, how is this different from, for example, sending user and pass?

@andrea.chiarelli-okta

10 ай бұрын

Client IDs and secret keys or API keys and secret keys are credentials for an application, that is, they identify the application, not the user. You can think of them as usernames and passwords, but just for the applications. An ID token simply tells an application that the user has been authenticated. An access token allows an application to access a resource on behalf of a user without using the user's username and password. So, both ID tokens and access tokens don't identify an application, while client IDs/API keys + secret keys do.

@user-rd4oo1jg5g

10 ай бұрын

@@andrea.chiarelli-okta Thanks for all! for example when I have 2 internal applications that connect through an api or an internal application with an external one but I always use the same user to authenticate, would I use client and secret to be able to generate and use the token?

JWT sounds like "Jawt". I call them JWT "jawt" tokens because that is what I see when I see the three letters.

Ok so what token can be sent to API if not ID token and auth token?

@mraible

10 ай бұрын

It should be an access token. When you use authorization code flow with OpenID Connect, you'll get both an ID token and access token.

"ID Tokens should NOT be sent to an API" is still confusing for me. I guess in most cases you want a single sign on in your web application, so you do not have to deal with the user managemnet yourself. Now probably your web application consists of a frontend (let's say a SPA) and one (or more) backend. In this case, are the frontend and the backend different clients, with different client ids? Now, in the backend of my web app, I need to identify the user because it is my backend which has to do the authorization (in most of the cases checking the userid (sub) against an access control list). But apprently I can not use the id token for that purpose? Looking at a how-to from google-developes this seems to be the way to go: kzread.info/dash/bejne/nJNnk8qDpLrQnNo.html ... What is your preferred way of identifying an user in the backend? Using the backend's client_secret to introspect the id token, or use the access token to call the userinfo endpoint of the ID provider?

@mraible

Жыл бұрын

There are two techniques I recommend for solving this problem: 1) add additional claims with identity information to your access tokens or 2) call the /userinfo endpoint on the backend with the access token to get identity info. If you do #2, you'll probably want to cache lookups for scalability.

"...maybe not that stressful..." Sir, it definitely is. xD

Can somebody explain to me about accesstoken more clearly???? 😅

@aaronpk

Жыл бұрын

Check out this video! kzread.info/dash/bejne/dIJ50a2eqM_TcZc.html

Thanks for the video, is it possible to get the access token when the scope is set to openid? If yes, flow used in OAuth2.0 can be followed in Openid as well?

I miss the dislike counts being visible, KZread fucked users and creators. I’m sure this video has so little dislikes, a shame not to display the winning ratio

TL;DR - ID tokens are for id. Access tokens are for access. So confusing.

@hobbit125

Ай бұрын

The continued conflation of Authentication and Authorization is perpetuated by people using the horrible abbreviation "auth." For example, "OAuth" or "Auth0."

recap: ID token is the token return from JWT, Access token is the token return from Oauth2

What is Identify provider? When we initially login / authenticate (a user) , is it against the Identify provider? Does identify provider provide the ID Token?

@mraible

8 ай бұрын

The identity provider is the one that provides the authorization server. For example, Google is an identity provider, as is Okta and Auth0. When you initially authenticate, you do that with the authorization server and it provides the ID token.