OpenID Connect

Problem

OAuth answers: “May this application access something?” But applications also need a standardized way to answer: “Who is the user who just logged in?”

Solution — OpenID Connect

OIDC adds an identity layer on top of OAuth. The client can receive an ID token containing authenticated identity information.

User → Identity Provider
             ↓
          ID token
             ↓
         Application

Core idea: OAuth is primarily delegated authorization; OIDC adds standardized authentication.