What it means
OpenID Connect, or OIDC, defines how an identity provider issues an ID token describing an authentication event and user identity. It uses OAuth flows and endpoints but serves a different purpose from an OAuth access token, which authorizes access to a resource.
How it works
The relying party sends an authentication request, validates the authorization response, and verifies the ID token's signature, issuer, audience, expiration, nonce, and other required claims. Discovery metadata and published signing keys support interoperability and key rotation.
A SaaS application redirects an employee to the organization's identity provider. After successful authentication, the application validates the returned ID token and creates a session for the identified employee.
Practical focus
- Validate issuer, audience, nonce, signature, and time claims
- Use discovery metadata only from trusted issuers
- Keep ID tokens and access tokens distinct
- Map external identity claims to local authorization cautiously
Common mistakes
- Sending an ID token to an API as though it were an access token
- Accepting tokens intended for another client
- Trusting unvalidated email or group claims for privileged access
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: