title: OAuth2 Password Grant vs OpenID Connect
body: <p>I've been reading about OAuth and OpenID Connect extensively, but this question is specifically about the OAuth2 Resource Owner Password Grant (aka OAuth2 Resource owner credentials Grant, aka OAuth2 Password Grant)</p>
  
  <p>Some resources (like the book "OAuth2 in Action" by Justin Richer) says <strong>not to use OAuth2 Resource Owner Password Grant for authentication</strong> - see section 6.1.3 in the book.</p>
  
  <p>Other good resources like the following <strong>all say we can use the OAuth2 Resource Owner Password Grant to essentially authenticate users via trusted apps</strong>:</p>
  
  <ol>
  <li><a href="https://www.oauth.com/oauth2-servers/access-tokens/password-grant/" rel="noreferrer">https://www.oauth.com/oauth2-servers/access-tokens/password-grant/</a></li>
  <li><a href="https://stormpath.com/blog/the-ultimate-guide-to-mobile-api-security" rel="noreferrer">https://stormpath.com/blog/the-ultimate-guide-to-mobile-api-security</a></li>
  <li><a href="https://www.youtube.com/watch?v=FNz0Lupp8HM&amp;index=60&amp;list=PLyUlngzGzkztgTizxM6_zqiw8sRj7vBm0" rel="noreferrer">https://www.youtube.com/watch?v=FNz0Lupp8HM&amp;index=60&amp;list=PLyUlngzGzkztgTizxM6_zqiw8sRj7vBm0</a></li>
  <li><a href="https://docs.apigee.com/api-services/content/implementing-password-grant-type" rel="noreferrer">https://docs.apigee.com/api-services/content/implementing-password-grant-type</a></li>
  <li><a href="https://oauth2.thephpleague.com/authorization-server/which-grant/" rel="noreferrer">https://oauth2.thephpleague.com/authorization-server/which-grant/</a></li>
  <li><a href="https://aaronparecki.com/oauth-2-simplified/#others" rel="noreferrer">https://aaronparecki.com/oauth-2-simplified/#others</a></li>
  </ol>
  
  <p>But I'm having a hard time understanding why we shouldn't use the OAuth2 Resource Owner Password Grant as essentially proof of a successful authentication?</p>
  
  <p>My understanding of Resource Owner Password Grant flow is that a username and password is provided by the end user to the trusted client (my native app), which then forwards it to my API's OAuth server and exchanges it for an access token (and optional refresh token) that it can use for the rest of the authenticated API endpoints. The native app doesn't save the username/password, but instead relies on the short-lived access token and the longer-lived refresh token (to get fresh access tokens when they expire).</p>
  
  <p>Why would I even need OpenID Connect? Why can't I just use OAuth2 Resource Owner Password Grant as an authentication mechanism?</p>
  
  <p><strong>Both the native app and the API are developed by the same person (me).</strong></p>
  
  <p>Any explanations would be welcome. Thank you.</p>