Backend interview prep

Start

OIDC vs OAuth2 Interview Questions and Answers

Learn the differences between OpenID Connect (OIDC) and OAuth2 with interview questions, Mermaid diagrams, Spring Security examples, and enterprise best practices.

OIDC vs OAuth2 - Interview Questions & Answers

One of the most frequently asked Spring Security interview questions is:

What is the difference between OAuth2 and OpenID Connect (OIDC)?

Many developers think they are the same, but they solve different problems.

  • OAuth2 is an Authorization Framework.
  • OpenID Connect (OIDC) is an Authentication Protocol built on top of OAuth2.

Modern enterprise applications almost always use OIDC + OAuth2 together.

Q1. What is OAuth2?

Answer

OAuth2 is an authorization framework that allows one application to access another application's resources without sharing the user's password.

OAuth2 focuses on:

  • Authorization
  • Delegated Access
  • Access Tokens
  • API Security

OAuth2 Overview

flowchart LR

User --> Client

Client --> AuthorizationServer

AuthorizationServer --> AccessToken

AccessToken --> ResourceServer

Example

A shopping application accesses a customer's Google Drive using an Access Token instead of the customer's password.

Q2. What is OpenID Connect (OIDC)?

Answer

OpenID Connect (OIDC) is an identity layer built on top of OAuth2.

OIDC adds authentication capabilities by introducing:

  • ID Token
  • UserInfo Endpoint
  • Standard User Claims

OIDC Overview

flowchart LR

User --> IdentityProvider

IdentityProvider --> IDToken

IdentityProvider --> AccessToken

IDToken --> Client

Example

A user signs in to a Spring Boot application using a Google account.

Q3. What is the main difference between OAuth2 and OIDC?

Answer

The biggest difference is their purpose.

OAuth2 OpenID Connect
Authorization Authentication
Access Token ID Token + Access Token
API Access User Login
Resource Protection User Identity

Comparison

flowchart TD

OAuth2 --> Authorization

Authorization --> ProtectedApis["Protected APIs"]

OIDC --> Authentication

Authentication --> UserIdentity["User Identity"]

Interview Tip

  • OAuth2 answers "What can this application access?"
  • OIDC answers "Who is the authenticated user?"

Q4. What tokens are issued by OAuth2 and OIDC?

Answer

OAuth2

Issues:

  • Access Token
  • Refresh Token (optional)

OIDC

Issues:

  • ID Token
  • Access Token
  • Refresh Token (optional)

Token Comparison

flowchart LR

OAuth2 --> AccessToken

OIDC --> IDToken

OIDC --> AccessToken

OIDC --> RefreshToken

Q5. What is the difference between an ID Token and an Access Token?

Answer

ID Token Access Token
Authentication Authorization
Used by Client Used by Resource Server
Contains User Claims Grants API Access
OIDC OAuth2

Token Usage

flowchart LR

IdentityProvider --> IDToken --> Client

IdentityProvider --> AccessToken --> ResourceServer

Best Practice

  • Client validates the ID Token.
  • Resource Server validates the Access Token.

Q6. Can OAuth2 be used without OIDC?

Answer

Yes.

OAuth2 alone is sufficient when user identity is not required.

Examples:

  • Microservice communication
  • API Gateway
  • Batch Processing
  • Backend Integrations

OAuth2 Only

flowchart LR

ServiceA --> AuthorizationServer

AuthorizationServer --> AccessToken

AccessToken --> ServiceB

Example

Order Service calling Payment Service using the Client Credentials Flow.

Q7. Can OIDC be used without OAuth2?

Answer

No.

OIDC is built on top of OAuth2.

OIDC depends on OAuth2 features such as:

  • Authorization Endpoint
  • Token Endpoint
  • Access Token
  • Authorization Code Flow

Relationship

flowchart TD

OAuth2 --> Foundation

Foundation --> OIDC

OIDC --> Authentication

Q8. How do Spring Security applications use OAuth2 and OIDC?

Answer

Spring Security commonly combines both.

Typical flow:

  1. User authenticates using OIDC.
  2. Identity Provider returns:
    • ID Token
    • Access Token
  3. Client validates the ID Token.
  4. Client uses the Access Token to call protected APIs.

Spring Security Flow

flowchart TD

User --> SpringBootClient

SpringBootClient --> IdentityProvider

IdentityProvider --> IDToken

IdentityProvider --> AccessToken

AccessToken --> SpringBootAPI

Popular Identity Providers:

  • Keycloak
  • Okta
  • Auth0
  • Microsoft Entra ID
  • Google Identity
  • Amazon Cognito

Q9. What are common interview mistakes regarding OAuth2 and OIDC?

Answer

Common misconceptions include:

  • Saying OAuth2 is an authentication protocol
  • Using an ID Token to call REST APIs
  • Confusing ID Tokens with Access Tokens
  • Skipping ID Token validation
  • Assuming OAuth2 provides user identity
  • Ignoring OpenID Connect claims

Wrong Understanding

OAuth2

↓

Authentication ❌

Correct Understanding

OAuth2

↓

Authorization ✅

OIDC

↓

Authentication ✅

Q10. What are the enterprise best practices for OAuth2 and OIDC?

Answer

Modern enterprise applications should:

  • Use OIDC for user authentication.
  • Use OAuth2 for API authorization.
  • Validate ID Tokens.
  • Validate Access Tokens.
  • Use Authorization Code Flow.
  • Use PKCE for public clients.
  • Keep Access Tokens short-lived.
  • Store Refresh Tokens securely.
  • Enable MFA.
  • Use HTTPS everywhere.
  • Monitor authentication and authorization events.

Enterprise Architecture

flowchart TD

User --> IdentityProvider

IdentityProvider --> OIDC

OIDC --> IDToken

OIDC --> OAuth2

OAuth2 --> AccessToken

AccessToken --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootMicroservices["Spring Boot Microservices"]

Authentication & Authorization Pipeline

flowchart LR

UserLogin["User Login"] --> OidcAuthenticationIdToken["OIDC Authentication → ID Token → OAuth2 Authorization → Access Token → Protected APIs"]

OIDC vs OAuth2

mindmap
  root((OIDC vs OAuth2))
    OAuth2
      Authorization
      Access Token
      API Security
    OIDC
      Authentication
      ID Token
      User Identity
      UserInfo Endpoint

Senior Interview Tip

A production-ready enterprise architecture combines both technologies:

  • OpenID Connect (OIDC) → User Authentication
  • OAuth2 → Authorization
  • JWT → Token Format
  • Spring Security → Security Enforcement
  • Spring Authorization Server → Token Issuance
  • API Gateway → API Protection
  • mTLS → Service Authentication
  • MFA → Strong User Authentication
  • Zero Trust Architecture → Continuous Verification

Remember this simple rule:

  • OAuth2 = Authorization
  • OIDC = Authentication + OAuth2

Quick Revision

  • OAuth2 is an authorization framework.
  • OIDC is an authentication protocol built on top of OAuth2.
  • OAuth2 issues Access Tokens.
  • OIDC issues ID Tokens and Access Tokens.
  • ID Tokens identify users.
  • Access Tokens authorize API access.
  • OAuth2 can be used without OIDC.
  • OIDC cannot work without OAuth2.
  • Spring Security commonly uses OIDC for login and OAuth2 for API access.
  • Modern enterprise applications combine OIDC, OAuth2, JWT, MFA, API Gateways, and Zero Trust.