Auth Standards Deep Dive · 2 of 6

OpenID Connect — Authentication on Top of OAuth

OpenID Connect (OIDC) adds an authentication layer on top of OAuth 2.0. OAuth tells you what an app is allowed to do; OIDC tells you who the user is. It's the protocol behind "Sign in with Google", "Sign in with Microsoft", and most modern enterprise SSO. Same flows as OAuth, plus a signed ID token that authoritatively identifies the user.

SSOID TokenJWKSDiscoveryFederation
← Back to Security
Quick Facts

What OIDC Is

Basic Concepts

  • Built on OAuth 2.0. Same flows (Authorization Code + PKCE), same endpoints, same scopes — plus standardized identity behavior.
  • The openid scope turns an OAuth flow into an OIDC flow. The auth server then returns an ID token (a signed JWT) alongside the access token.
  • ID Token: a signed JWT with claims like sub (subject — the user ID), iss (issuer), aud (audience — your client ID), exp (expiry), email, name.
  • Discovery: every OIDC provider exposes /.well-known/openid-configuration. One URL gives you all the endpoints, supported flows, signing keys URI, and capabilities.
  • JWKS: the jwks_uri in the discovery doc returns the public keys used to sign ID tokens. Your app fetches and caches them; rotation just works.
Why It Wins

What OIDC Buys You

Standardized Identity

Before OIDC, every social-login provider invented its own user-info endpoint and claim names. OIDC standardized them — sub, email, name, picture, locale — so the same code works against Google, Microsoft, Okta, Auth0, Keycloak, your enterprise IdP. Plug-and-play federation.

The ID Token Is Authoritative

An OAuth access token says "the bearer can call this API." An OIDC ID token says "the user with this sub just authenticated at this issuer." It's signed; it has an audience; it expires. You verify it locally without calling the auth server again.

Discovery Eliminates Boilerplate

You don't hard-code endpoints. Point your library at https://accounts.example.com and it discovers everything. New IdP onboarding is one config line.

Single Sign-On Across Apps

Once a user has authenticated at the OIDC provider, every other app that trusts the same provider gets seamless login. The basis of modern SSO — within a company, across SaaS, even across organizations via federation.

The Flow

What Login Looks Like

  1. User clicks "Sign in with Google."
  2. Your app redirects to Google's authorize endpoint with scope=openid email profile, a PKCE challenge, and a state param.
  3. User authenticates at Google, consents to scopes.
  4. Google redirects back to your app's redirect_uri with a code and the original state.
  5. Your backend exchanges code + PKCE verifier for tokens at Google's token endpoint.
  6. You receive an ID token (and an access token, and optionally a refresh token).
  7. You verify the ID token: signature against JWKS, iss matches Google, aud matches your client ID, exp in the future, nonce matches the one you sent.
  8. You read sub as the user's stable ID, look up or create the user, issue your own session.
Pitfalls

The Mistakes That Recur

Skipping ID Token Validation

"It came from the redirect, it must be fine." No — verify the signature, the issuer, the audience, and the expiry. An ID token without validation is just a string an attacker can forge.

Treating Access Tokens as Identity

The ID token identifies the user. The access token authorizes API calls. They're different. Don't decode the access token to "see who the user is" — many auth servers issue opaque access tokens, and even when they're JWTs, the claims aren't guaranteed.

Trusting email Without email_verified

Some providers let users self-assert email addresses without verification. If you key your account lookup on email and the IdP didn't verify it, attackers can claim other people's accounts. Always check email_verified; prefer sub as the primary key.

Ignoring nonce

Generate a random nonce per login attempt; store it in the session; verify the ID token's nonce claim matches. This binds the ID token to the originating browser session, defending against replay.

Multi-Tenant Issuer Confusion

If you accept logins from multiple IdPs, you must validate iss against an allow-list and key the user not by sub alone but by (iss, sub). Otherwise two tenants' users with the same sub collide.

Decision

When to Use OIDC

OIDC is the right answer for almost every modern login flow:

  • Social login (Google, Microsoft, Apple, GitHub) — all of them speak OIDC.
  • Enterprise SSO for B2B SaaS — Okta, Azure AD, Auth0, Keycloak, OneLogin all support OIDC.
  • Internal company SSO across all your apps — much simpler than SAML for new builds.
  • Federation between organizations — partner orgs can authenticate users into your app via their own IdP.

Reach for SAML only when integrating with a partner that mandates it (typically older enterprise IdPs). For new builds, OIDC wins on simplicity, tooling, and JSON-everywhere ergonomics.

Continue

Other Auth Standards