OpenID Connect 简介

Welcome to OpenID Connect! OIDC is an identity layer built on top of the OAuth2.0 protocol.

While OAuth2 is all about authorization (granting access to resources), OIDC adds the crucial element of authentication (verifying user identity).

Think of it this way:

• OAuth2: "You can access my photos." (Authorization)
• OIDC: "You are John Doe." (Authentication)

OIDC uses OAuth2's authorization flows, but extends them to provide a standardized way for clients to verify an end-user's identity.

The 'identity layer' means OIDC provides a predictable format for identity information. It tells you who the user is, not just what they can access.

This is vital for applications that need to know the user's name, email, or other profile details after they've logged in.

The central piece of OpenID Connect is the ID Token. This is a security token that contains claims about the authentication event and the user.

When a user successfully authenticates with an OIDC Provider, an ID Token is issued to the client application.

The ID Token is always a JSON Web Token (JWT). This means it's a compact, URL-safe means of representing claims between two parties.

Being a JWT, the ID Token is cryptographically signed by the Identity Provider, ensuring its integrity and authenticity.

An ID Token (JWT) contains various 'claims' – pieces of information about the user and the authentication event. Some standard claims include:

• iss: Issuer (who issued the token)
• sub: Subject (unique identifier for the user)
• aud: Audience (for whom the token is intended)
• exp: Expiration Time
• iat: Issued At Time

These claims help the client verify the token and identify the user.

Just like with OAuth2, OIDC involves user consent. When your application requests identity information (like email or profile), the user is prompted to approve.

This ensures users have control over what personal data is shared with third-party applications.

Here's a simplified look at how OIDC works:

1. User clicks "Login with Google" (or similar) in your app.
2. Your app redirects the user to Google (the OIDC Provider).
3. User logs in and consents to share info.
4. Google redirects user back to your app with an ID Token.
5. Your app verifies the ID Token and logs the user in.

OIDC offers several benefits for modern applications:

• Single Sign-On (SSO): Users can log in once and access multiple applications.
• Standardization: Predictable way to get identity info across providers.
• Simplicity: Easier for developers to implement authentication than custom solutions.
• Mobile & Web Friendly: Designed to work well with various client types.

Based on what we've learned, what is the primary purpose of OpenID Connect?

Great job! You now understand the fundamentals of OpenID Connect.

• OIDC builds on OAuth2 to add an identity layer.
• It focuses on authentication: verifying who the user is.
• The core component is the ID Token, a signed JWT with user claims.
• OIDC simplifies SSO and provides a standardized way to get user identity.

Next, we'll explore different OAuth2 Grant Types, which OIDC also leverages.