OpenID Connect

Overview

OpenID Connect (OIDC) extends OAuth 2.0 with identity features and standard claims, enabling single sign-on and federated identity.

Key Elements

• ID token for user identity
• UserInfo endpoint for profile details
• Standard claims such as sub, email, and name

flowchart LR
    A[Application] --> B[OIDC Provider]
    B --> C[ID Token]
    C --> A
    A --> D[Resource API]

Practical Example

{
  "iss": "https://idp.example.com",
  "sub": "user-1024",
  "aud": "web-client",
  "exp": 1780000000,
  "email": "alice@example.com"
}

Production Example

Organizations commonly use OIDC with enterprise identity providers to centralize login, MFA policy, and account lifecycle management.

Common Pitfalls

• Accepting unsigned or weakly validated ID tokens
• Mixing access token and ID token purposes
• Missing nonce validation in browser-based flows

Key Takeaways

• OIDC standardizes authentication on top of OAuth 2.0.
• ID token validation must be strict and complete.
• Central identity reduces account and policy drift.