I'm trying to come up with an secure way of authorization and identification and everything seems to point using OpenID Connect but I've noticed not many apps actually use OpenID Connect since I never see the case where someone has to sign in to a provider. Most apps use username and password for identity instead of OpenID. Is that really appropriate these days? I know OpenID is for identification, but I'm curious as to why no one really uses it anymore. To follow the trends, I suppose I should just use OAuth2 by itself for the highest authentication security to authorize API calls made by the user? Reading online has made me ultimately confused. Do I need to use OpenID Connect for identity + authorization or username / password + OAuth2? Also, is AccountManager in Android the best way to handle OAuth2 authorization?
0 Answers
Related