Beginner LevelAuthentication & Authorization
What is OpenID Connect (OIDC) and how does it extend OAuth 2.0 for Identity?
❓ Interview Prompt: Explain why OAuth 2.0 is not an authentication protocol, OIDC identity extension, ID Tokens, and /userinfo.
OAuth 2.0 is strictly an Authorization Framework (delegating access rights). Using raw OAuth 2.0 for user authentication creates security flaws (pseudo-authentication). OpenID Connect (OIDC) is an identity layer built directly on top of OAuth 2.0.
What OIDC Adds to OAuth 2.0:
1
ID Token (JWT): A cryptographically signed token containing standardized identity claims ('sub', 'name', 'email', 'iss', 'aud').
2
Standardized Scopes: Defines 'openid', 'profile', 'email', 'address', 'phone'.
3
'/userinfo' Endpoint: Standardized API endpoint to fetch user profile attributes using the access token.
4
Discovery Document: '/.well-known/openid-configuration' metadata endpoint listing IdP URLs and public keys.
Code Implementation Example
typescript
// Validating OIDC ID Token claims
import jwt from 'jsonwebtoken';
function verifyIdToken(idToken: string, expectedClientId: string, idpPublicKey: string) {
const claims = jwt.verify(idToken, idpPublicKey, { algorithms: ['RS256'] }) as jwt.JwtPayload;
// Enforce OIDC claim validations
if (claims.iss !== 'https://auth.enterprise.com') throw new Error('Invalid Issuer');
if (claims.aud !== expectedClientId) throw new Error('Audience Mismatch');
if (claims.exp! < Date.now() / 1000) throw new Error('Token Expired');
return { userId: claims.sub, email: claims.email };
}💡Validating OpenID Connect (OIDC) ID Token claims (iss, aud, sub, exp).
🎯 Interview Key Takeaway
OIDC extends OAuth 2.0 by adding signed ID Tokens and standardized identity endpoints for user authentication.
#OIDC#OpenID Connect#ID Token#OAuth 2.0#Beginner
Back to all Authentication & Authorization Questions→