Learn how OpenID Connect enhances authentication by building on top of the OAuth 2.0 protocol to provide a secure, standard way to authenticate users.

Table of Contents

1. What is OpenID Connect?
2. How OIDC Works
3. OIDC vs OAuth 2.0
4. Benefits of OIDC
5. ID Tokens Explained
6. Implementing OIDC
7. Security Considerations
8. Troubleshooting
9. Glossary

---

What is OpenID Connect?

OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol. It allows clients (like Esadax) to verify the identity of users based on authentication performed by an authorization server.

• Developed by the OpenID Foundation.
• Widely adopted in modern web and mobile applications.
• Used by Google, Microsoft, Auth0, Okta, and more.

---

How OIDC Works

1. User attempts login on the client application.
2. Client redirects the user to the Identity Provider (IdP).
3. User authenticates with the IdP (e.g., username + password, 2FA).
4. IdP redirects back to the client with an ID token and (optionally) an access token.
5. Client verifies the ID token’s signature and claims.
6. User is authenticated and a session is created.

---

OIDC vs OAuth 2.0

Feature	OAuth 2.0	OpenID Connect (OIDC)
Purpose	Authorization	Authentication
Token Type	Access Token	ID Token + Access Token
User Identity	Not guaranteed	Explicitly provided
Profile Data Access	Requires extra scopes	Supported via openid scope
Standardized Claims	No	Yes

✅ OIDC = OAuth 2.0 + identity + standardized user info.

---

Benefits of OIDC

• Interoperability: Standard across many providers and platforms.
• Security: Uses signed tokens and proven flows.
• Flexibility: Works for web apps, mobile apps, and APIs.
• Scalability: Ideal for distributed or multi-tenant systems.
• Federated Identity: One login works across many services.

---

ID Tokens Explained

An ID Token is a JWT (JSON Web Token) that contains information about the user.

• Common Claims:
  • sub: Subject (user ID)
  • email: User's email
  • name: Full name
  • iat: Issued at
  • exp: Expiry
  • iss: Issuer
  • aud: Audience (your app)

Example decoded ID token payload:

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "email": "jane@esadax.com",
  "iat": 1692547200,
  "exp": 1692550800,
  "iss": "https://auth.provider.com",
  "aud": "esadax-app"
}

---

Implementing OIDC

1. Choose a Provider: Google, Auth0, Okta, or self-hosted (e.g., Keycloak).

2. Register your Application: Obtain a client ID and client secret.

3. Redirect Users to the Provider:

   • Include response_type=code and scope=openid.

4. Handle Callback:

   • Exchange the code for tokens using the provider’s /token endpoint.

5. Verify ID Token:

   • Check the signature, aud, exp, and other claims.

6. Create Session:

   • Use the token data to authenticate the user in your system.

---

Security Considerations

• Always validate ID tokens on the server side.
• Use HTTPS to avoid token interception.
• Set short token lifetimes and rotate secrets.
• Verify nonce to prevent replay attacks.
• Use PKCE (Proof Key for Code Exchange) for public clients like SPAs and mobile apps.

---

Troubleshooting

• Invalid Token Signature?

  • Ensure you’re using the correct public key (JWKS).

• Invalid Audience (aud)?

  • Check that the token was issued for your client ID.

• Token Expired?

  • Refresh the token or re-authenticate the user.

• Provider Not Redirecting?

  • Verify your redirect URI matches what's registered.

---

Glossary

• OIDC: OpenID Connect, an identity layer on top of OAuth 2.0.
• OAuth 2.0: A protocol for authorizing access to resources.
• IdP: Identity Provider (e.g., Google, Okta) that authenticates the user.
• ID Token: A JWT that confirms the identity of the user.
• Access Token: A token used to access protected APIs.
• PKCE: Security extension to OAuth 2.0 for public clients.

---