Auth
OpenID Connect
An authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
What it is
OpenID Connect (OIDC) adds the answer to "who is this" on top of OAuth 2.0. Besides the access token the provider returns an ID token as a JWT with the user identifier and login time.
The standard defines the openid scope, a userinfo endpoint, a discovery document at /.well-known/openid-configuration and a set of standard claims (sub, email, name).
OIDC is what stands behind "Sign in with Google" buttons and corporate SSO on Entra ID, Okta or Keycloak.
Use it when
- User sign-in through an external provider (social login).
- Single sign-on (SSO) for several company apps.
- You need standard, interoperable authentication.
Avoid it when
- Only API access authorization with no need to know the user: OAuth 2.0 is enough.
- A very simple app where your own passwords and sessions suffice.
Key concepts
- ID token
- A JWT signed by the provider with facts about the authentication.
- Claims
- User fields:
sub,email,name. - Discovery
.well-known/openid-configurationlisting all provider endpoints.- Nonce
- A random value against token replay.
Example
Interview questions
1. How does an ID token differ from an access token?
The ID token is for the client and says who the user is. The access token is for the API and says what is allowed. Do not send the ID token to an API as a permission.
2. What do you verify in an ID token?
The signature (keys from JWKS),
iss,aud,expandnonce. Without these checks the token cannot be trusted.3. What is
/.well-known/openid-configurationfor?The client discovers endpoint URLs, supported scopes and the JWKS automatically. That simplifies connecting any provider.
Interview questions from the bank
- An SPA still logs users in with the implicit flow: the
access_tokenarrives in the URL fragment. An audit demands a move to the authorization code flow with PKCE, and the frontend wants to get the user's name and email by decoding theaccess_token. What is wrong with both, and what should the flow look like?MiddleHTTP - The authorization code flow has
state,nonceandcode_verifier. What does each one protect against?MiddleWeb security - A user pressed 'Log out' in an app that signs in through Keycloak. What should happen on the client, in the backend and in the provider?MiddleWeb security
- An API accepts tokens from a shared realm, and a pentest got into the API with an id token. Why is this a problem and how do you fix it?MiddleWeb security
Related technologies
- OAuth 2.0A delegated authorization standard: an app gets limited access to a user's resources without their password.
- JWTA compact signed token in JSON format that carries claims about a user or permissions.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
- Auth0A managed authentication and authorization service: sign-in, SSO, MFA and API access with no identity server of your own.
- Auth.jsAn open source authentication library for web apps (formerly NextAuth.js), with OAuth providers and sessions.
- ClerkA managed authentication service with ready React components for sign-in, profile and organizations.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).