OpenID Connect

OpenID Connect is an identity layer on OAuth 2.0 that lets a client verify a user's authentication and receive identity claims from an OpenID Provider.

What OpenID Connect adds

OAuth 2.0 handles authorization. OpenID Connect adds a standard way for an application to learn who signed in. An OIDC request includes the openid scope; the provider returns an ID token containing claims about the user’s authentication.

The application is called the relying party because it relies on the provider’s authentication. It validates the response before accepting the sign-in. The ID token entry explains the checks and fields involved.

One sign-in, separate jobs

An application can use OpenID Connect to sign someone in and OAuth to obtain access to an API during the same flow. That does not make the resulting tokens interchangeable: the ID token is for the client, while the access token is for the protected API.

OpenID Connect also defines a UserInfo endpoint where a client can request identity claims using an access token. Which profile details it receives depends on the requested claims and what the provider is allowed to release.

Sources

See it in practice