Difference between Google "OpenID Connect" and "sign-in with Google"?

15
votes

I want users to my website to use Google Accounts to authenticate / sign in to my website. The primary use case being users will edit and generate content and we want to log ownership in a secure way. We are not interested in obtaining users Google data, we just want a means to authenticate users.

After googling, I came across some documentation, which seems to explain how to do this OpenID Connect (OAuth 2.0 for Login). But the documentation immediately says "Note: If you want to provide a “sign-in with Google” button for your website or app, we recommend using Google+ Sign-In, ...", which if you follow the link ultimately takes you to Google+ Sign-In.

What's the difference between these two pages of documentation? Why does the first tell you to go to the second while not saying the first is deprecated? Are both/either suitable for my use case? All it says is "we recommend" I want to know WHY, WHY do they recommend it?

UPDATE: I also found yet another link which seems to be documenting another approach https://developers.google.com/accounts/docs/OAuth2WebServer I think this is just for "Authorization" i.e. authorizing your app to make google api calls to get user data, so cannot be used for authenticating/sign-in.

BTW I'm building my website with a Scala Spray BE REST API & NG JS FE.

1
authenticationoauth-2.0openidgoogle-oauthgoogle-openid

1 Answers

6
votes

A comparison of the two is available here.

Google+ Sign-In with profile scope

  • Has Google client libraries for authenticating with OAuth 2.0, which includes support for Google+ and other Google services (like getting social information on a user). Also this can make implementing easier and requires less boiler plate code
  • Has the Google+ Sign-In button to simplify sign-in Has no pre-built widgets
  • Supports over-the-air Android installs

OAuth login is primarily just for authentication at a lower level, that is by making raw HTTP requests, no API.

OpenID Connect protocols (OAuth 2.0 login) Google+ Sign-In supports OIDC interoperability if you configure with the openid scope and get the user profile using getOpenIdConnect.

OAuth 2.0 login supports OIDC directly. Use it for signing in users to apps that do not need social features and run on platforms not supported by Google+ Sign-In.