Which statement best describes OAuth and OpenID Connect relation?

• A. OAuth is an authorization framework; OpenID Connect adds authentication with identity tokens on top of OAuth.
• B. OAuth handles authentication; OpenID Connect handles authorization.
• C. OAuth is a data storage protocol; OpenID Connect handles data encryption.
• D. OAuth and OpenID Connect are identical in purpose.

Answer: (A)

OAuth 2.0 handles authorization: it defines how a client obtains a token that grants access to a resource on behalf of a user. It does not establish who the user is. OpenID Connect sits on top of OAuth 2.0 and adds authentication by issuing identity tokens that prove the user's identity and may provide basic profile information. This pairing lets an app log the user in while also obtaining permission to access the user’s resources using the same framework. The idea that OAuth authenticates or that OpenID Connect handles encryption or storage misses the actual roles: OAuth is about proving permission to access, not who the user is, and OpenID Connect supplies a standard way to verify identity atop that foundation.