An identity layer built on top of the OAuth 2.0 authorization framework, published by the OpenID Foundation in 2014. Where OAuth answers what is this app allowed to access?, OIDC answers who is this user? It powers most of the Sign in with Google, Sign in with Microsoft, and enterprise SSO buttons on the web.
Key OIDC Components
- Identity Provider (IdP): The OpenID Provider that authenticates the user and issues tokens.
- Relying Party: The application that trusts the provider to authenticate its users.
- ID Token: A signed JWT containing claims about the user, such as subject identifier, email, and authentication time.
- UserInfo Endpoint: An API the application can call with an access token to retrieve additional profile claims.
- Discovery Document: A well-known configuration URL that publishes the provider’s endpoints and signing keys.
Common OIDC Flows
- Authorization Code Flow: The recommended flow for web and mobile apps, protected with PKCE.
- Client Credentials: Used for machine-to-machine access where no user is present (an OAuth flow without identity).
- Implicit Flow: A legacy browser flow now discouraged in favor of authorization code with PKCE.
