OpenID Connect (OIDC) Example

Key Takeaways

• OpenID Connect (OIDC) adds an identity layer to OAuth2, enabling authentication along with authorization.
• OIDC uses ID tokens to convey user identity information over authentication flows.
• OIDC has different flows (Authorization Code, Implicit, Hybrid) to suit various client types.
• The UserInfo endpoint in OIDC retrieves additional user information via access tokens.

What is OpenID Connect?

OpenID Connect (OIDC) is an identity layer that works on top of OAuth2, seizing its authorization infrastructure to add authentication capabilities.

If you aren't familiar with OAuth2, you might want to check out a quick OAuth2 example to get up to speed on the core concepts and how OIDC extends them.

OpenID Connect Example

Consider logging into an application using Facebook.

The OpenID Provider (OP) is Facebook, and the Relying Party (RP) is the application you’re trying to access.

1. The RP redirects the user to the OP.
2. The OP authenticates the user using credentials or other verification methods.
3. The OP redirects the user back to the RP with an authorization code.
4. The RP sends a token request to the OP including the authorization code.
5. The OP responds with an ID token, an access token, and optionally a refresh token.
6. The RP uses the ID token to obtain profile information about the user.
7. The RP uses the access token to make authorized requests to the OP's protected API.

The OpenID Connect Flow

OIDC builds upon existing OAuth2 flows:

Authorization Code Flow: As illustrated in the example, this flow involves obtaining an authorization code which is then exchanged for tokens. This method is secure for clients with backends to store tokens safely.

Implicit Flow: This flow skips the authorization code step, returning the ID token directly. It suits public clients like Single Page Applications (SPAs) that cannot store tokens securely. SPAs needing only authentication often use this flow to acquire an ID token safely.

Hybrid Flow: A combination of the other two flows, it uses front-channel communication to deliver the ID token and authorization code. After ID token validation, the backend uses the authorization code for additional token acquisition, accessing APIs securely.

ID Tokens

ID tokens are central to OIDC, distinguishing it from basic OAuth2. These tokens contain user claims — attributes that define who the user is.

This feature enables OIDC to provide authentication in addition to OAuth2’s authorization.

Here’s an example of an ID Token:

{
  "iss": "http://your-app.com",
  "sub": "auth0|123456",
  "aud": "your_client_id",
  "exp": 1711281970,
  "iat": 1711280970,
  "name": "Alex Johnson",
  "given_name": "Alex",
  "family_name": "Johnson",
  "birthdate": "1990-11-15",
  "email": "alex@example.com",
  "picture": "http://example.com/alex/me.jpg"
}

The attributes or user claims in these tokens can vary by OIDC implementation, but the specification mandates:

• iss: The issuer, aka the OpenID provider
• sub: A unique user identifier
• exp: Token expiration time
• iat: Time the token was issued

The UserInfo Endpoint

OIDC provides UserInfo endpoints at OpenID providers. These endpoints can supply extra user information or claims by receiving a valid access token, returning detailed user profiles when standard ID tokens can’t accommodate large claims.

OpenID Connect vs OAuth2

OIDC enhances OAuth2 by adding an identity layer that enables authentication without replacing OAuth2.

Where OAuth2 authorizes clients to access user data on other sites, it doesn’t inherently verify the user’s identity. OIDC solves this by allowing client applications to confirm the identity of the user accessing resources.

FAQ

What is the main difference between OIDC and OAuth2?

OIDC adds authentication on top of the authorization infrastructure provided by OAuth2, using ID tokens to include identity information.

When should I use OpenID Connect?

Use OIDC when you need both user authentication and secure authorization for accessing APIs, particularly when profiling and understanding who the user is, is critical.

Can I use OIDC without OAuth2?

No, OIDC is designed to work in conjunction with OAuth2, utilizing its framework to support new authentication capabilities.