Learn who signed in with OpenID Connect.
OpenID Connect, or OIDC, adds a standard authentication result to OAuth. It uses an ID token to tell the application about the user’s sign-in.
Why this lesson?
The order app also needs to know which customer signed in. It uses a verified ID token to create the correct user session.
Learning goal and prerequisites
Request an OIDC sign-in
The application requests the openid scope to use OpenID Connect. It also sends a random nonce and saves it. The application later compares this nonce with the value in the ID token to connect the result to this sign-in request.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
OAuth was designed to authorize access to protected resources. An application that receives an OAuth access token should not automatically treat that token as a standard statement about who signed in. OpenID Connect adds an authentication layer so a client can receive a defined identity result from the authorization server.
OpenID Connect uses an ID token. An ID token is a signed token intended for the client application. It contains claims about the authentication event and the user, including a stable subject identifier. The client validates the issuer, audience, signature, time limits, and other required values before using the identity result.
This is useful when an application needs both authorization and sign-in. The access token is for the protected application programming interface (API). The ID token is for the client that needs to know who authenticated. Keeping those purposes separate prevents the client from guessing identity from an API credential that was not designed for that job.
OpenID Connect does not tell the application what the user may do inside the application. After the identity is verified and a local session is created, the application still needs its own authorization rules for orders, files, settings, or other protected resources.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.