OIDC：OAuth2 上的身份层

You've learned about OAuth2 for authorization. Now, let's explore OpenID Connect (OIDC), the identity layer built on top of OAuth2.

OIDC helps applications verify a user's identity and get basic profile information securely.

Remember, OAuth2 is an authorization protocol. It's designed to grant limited access to a user's resources without sharing their credentials.

• It tells you what a client can do.
• It doesn't tell you who the user is.

Imagine a user logging into an app using their Google account. OAuth2 would let the app access their Google Drive, but it wouldn't inherently tell the app the user's name or email.

Applications often need to know who the user is to personalize experiences or manage accounts.

This is where OpenID Connect comes in! OIDC is a simple identity layer built on top of the OAuth2 protocol.

It provides a standardized way for clients to verify the identity of an end-user based on the authentication performed by an Authorization Server.

At its heart, OIDC is about authentication. It answers the question: "Who is this user?"

• Confirms the user's identity.
• Ensures the user is who they claim to be.
• Done by an Identity Provider (IdP).

In OIDC, user identity is communicated through a special type of security token called an ID Token.

The ID Token contains pieces of information about the user, known as claims. These claims include things like the user's name, email, or a unique identifier.

The ID Token is a JSON Web Token (JWT). It's signed by the Identity Provider, allowing client applications to verify its authenticity.

It's the core component that carries the user's identity information from the Identity Provider to the client.

OIDC also enables identity federation. This means a user can use one set of credentials (e.g., their Google account) to log into multiple unrelated applications.

The Identity Provider acts as a trusted third party, federating the user's identity across different services.

OIDC brings several advantages:

• Single Sign-On (SSO): Users log in once and access multiple apps.
• Simplified Development: Standardized identity layer reduces complexity for developers.
• Enhanced Security: Builds on OAuth2's security features.

Let's test your understanding of the core difference between OAuth2 and OpenID Connect.

Great job! You now understand that OpenID Connect is an identity layer built on top of OAuth2.

• OAuth2: Authorization (what you can do).
• OIDC: Authentication (who you are), using ID Tokens and claims.

Next, we'll dive deeper into the structure and content of these powerful ID Tokens!