OpenID Connect (OIDC)

The Evolution of Identity Protocols

The web's approach to identity and authentication progressed through 4 distinct eras:

The Pseudo-Authentication Problem

Before OpenID Connect, developers attempted to use raw OAuth 2.0 Access Tokens as proof of user identity. As documented by oauth.net and Okta's identity architecture team:

Why Raw OAuth Fails for Authentication:

What is OpenID Connect (OIDC Core 1.0)?

OpenID Connect combined the best features of OAuth 2.0, Facebook Connect, and SAML 2.0 to establish a standardized, lightweight identity layer:

SAML 2.0 vs OIDC vs OAuth 2.0

OIDC Actors (Standard Terminology)

• End-User (Resource Owner): The human whose identity is being verified.
• Relying Party (RP / Client): The application requesting identity proof from the OpenID Provider.
• OpenID Provider (OP / Authorization Server): The identity server (Okta, Entra ID, Google) that authenticates the user and issues ID Tokens.

The ID Token Anatomy (RFC 7519 & OIDC Core 1.0)

The ID Token is a signed JSON Web Token containing standardized identity assertions:

// Decoded ID Token Payload (JSON)
{
  "iss": "https://authorization-server.example.com",
  "sub": "usr_998877",
  "aud": "my_client_app_id",
  "exp": 1755003600,
  "iat": 1755000000,
  "auth_time": 1754999990,
  "nonce": "n-0S6_WzA2Mj",
  "at_hash": "T7ij7o69gBtjo6bAJvaVBQ",
  "amr": ["pwd", "mfa"],
  "idp": "00o1zyyqo9bpRehCw1t7",
  "name": "Alice Chen",
  "email": "alice@authmatrix.local",
  "email_verified": true,
  "roles": ["Admin"]
}

Cryptographic Hash Bindings: at_hash & c_hash

When tokens are issued via front-channel redirects, OIDC uses mathematical hashes inside the ID Token to prevent token injection and substitution attacks:

The 14 Standard OIDC Profile Claims

Requesting scope=profile grants access to the full standardized profile claim schema defined in OIDC Core Section 5.1:

Where Do Claims Go? (ID Token vs /userinfo)

OIDC balances token size with performance based on the response_type and scope requested:

Dynamic Discovery & BYOI (Bring Your Own Identity)

OIDC enables internet-scale dynamic federation without pre-sharing XML certificates. An application can discover everything about an IdP by querying /.well-known/openid-configuration:

GET /.well-known/openid-configuration HTTP/1.1
Host: accounts.example.com

// Response
{
  "issuer": "https://accounts.example.com",
  "authorization_endpoint": "https://accounts.example.com/oauth2/v1/authorize",
  "token_endpoint": "https://accounts.example.com/oauth2/v1/token",
  "userinfo_endpoint": "https://accounts.example.com/oauth2/v1/userinfo",
  "jwks_uri": "https://accounts.example.com/oauth2/v1/keys",
  "response_types_supported": ["code", "id_token", "code id_token"],
  "subject_types_supported": ["public", "pairwise"],
  "id_token_signing_alg_values_supported": ["RS256"]
}

5-Step OpenID Connect Flow

sequenceDiagram
    autonumber
    participant RP as 💻 Relying Party (App)
    participant OP as 🌐 OpenID Provider (IdP)
    participant UserInfo as 👤 UserInfo Endpoint

    Note over RP,OP: Step 1: Dynamic Discovery (BYOI)
    RP->>OP: 1. GET /.well-known/openid-configuration
    OP-->>RP: 2. Metadata (jwks_uri, auth_endpoint, token_endpoint)

    Note over RP,OP: Step 2: User Authentication & Code Flow
    RP->>OP: 3. GET /authorize (scope=openid profile email, nonce=n-0S6)
    OP-->>RP: 4. 302 Redirect with Authorization Code

    Note over RP,OP: Step 3: Token Exchange & JWKS Key Fetch
    RP->>OP: 5. POST /token (code, grant_type=authorization_code)
    OP-->>RP: 6. Tokens { id_token (JWT), access_token }
    RP->>OP: 7. GET /.well-known/jwks.json
    OP-->>RP: 8. Public Verification Keys (kid, RSA Modulus, Exponent)

    Note over RP: Step 4: Local ID Token Verification
Verify RS256 signature, iss, aud, exp, nonce

    Note over RP,UserInfo: Step 5: (Optional) Extended Profile Fetch
    RP->>UserInfo: 9. GET /userinfo (Authorization: Bearer <access_token>)
    UserInfo-->>RP: 10. 200 OK { sub, name, email, picture, roles }
          

OIDC Response Types & Hybrid Flow Matrix