Are they the same?
-James Booz
An OAuth server and an Identity Provider (IdP) are both used for authentication and authorization, but they have different purposes:
An OAuth server is primarily used to protect APIs (i.e., resources) by enabling clients (e.g., mobile apps, web apps) to access them on behalf of a user. The server is responsible for issuing access tokens to clients that have been authorized by the user to access their resources. The access tokens can be used to make requests to the APIs without the need for the user’s credentials.
An Identity Provider (IdP) is used to authenticate users and manage their identities across multiple applications. An IdP acts as a trusted third-party that authenticates users and provides identity information to applications that rely on it. The IdP may use various authentication methods (e.g., username/password, two-factor authentication) to verify a user’s identity and can provide a range of user attributes (e.g., name, email address) to the application.
In summary, an OAuth server is primarily focused on protecting APIs and issuing access tokens to clients, while an Identity Provider is focused on authenticating users and managing their identities across multiple applications. However, some IdPs can also act as OAuth servers by providing access tokens for protected APIs.