OpenID

What Is OpenID?

OpenID is an open standard that allows users to authenticate themselves to multiple services using a single digital identity — often through a trusted third party like Google or Microsoft.

Originally launched to decentralize identity on the web, OpenID has evolved into OpenID Connect (OIDC), a modern protocol that builds on top of OAuth 2.0.

OpenID lets users sign into different services without creating a new password for each one.

1. OpenID vs OpenID Connect (OIDC)

Feature	OpenID 2.0 (legacy)	OpenID Connect (modern)
Built On	Custom protocol	OAuth 2.0
Purpose	Decentralized login	Federated authentication
Token Type	Identifier URL	ID Token (JWT) + Access Token
Still in Use?	No (deprecated)	Yes (widely adopted)

Today, when people refer to OpenID, they almost always mean OpenID Connect.

2. Why OpenID Matters

Reduces password fatigue for users
Improves security via centralized login
Enables federated identity between companies, apps, and domains
Powers “Sign in with Google/Facebook/Apple” buttons

3. Core Concepts in OpenID Connect

Term	Description
User (End-User)	The person authenticating
Relying Party (RP)	The app or service the user wants to access
OpenID Provider (OP)	The IdP that authenticates and provides identity (e.g., Google)
ID Token	A signed token that proves identity
Access Token	Authorizes access to APIs (via OAuth)
Discovery Endpoint	Metadata endpoint for OpenID Provider config
UserInfo Endpoint	API for user attributes (e.g., name, email)

4. OpenID Connect Authentication Flow

Example: Login with Google

User clicks “Login with Google”
App redirects to Google with OpenID scope
Google prompts login + consent
On success, Google returns an ID Token and optional Access Token
App verifies ID Token (JWT)
User is authenticated!

5. OpenID Connect Scopes

Scope	Purpose
`openid`	Required for OIDC
`profile`	Name, gender, locale, etc.
`email`	User’s email address
`address`	Physical address
`phone`	Phone number
`offline_access`	For refresh tokens

Example:

scope=openid email profile

6. ID Tokens

The ID Token is a JWT (JSON Web Token) issued by the OpenID Provider.

Sample JWT Header:

{
  "alg": "RS256",
  "typ": "JWT"
}

Sample Payload:

{
  "iss": "https://accounts.google.com",
  "sub": "110234512342345",
  "aud": "my-client-id.apps.googleusercontent.com",
  "email": "[email protected]",
  "exp": 1697212312
}

It proves that the user has been authenticated by the identity provider.

7. How OpenID Connect Relates to OAuth 2.0

Protocol	Purpose
OAuth 2.0	Authorization: What can you do?
OIDC	Authentication: Who are you?

OpenID Connect is an identity layer on top of OAuth 2.0.

8. Authentication vs Authorization

Function	Authentication (OIDC)	Authorization (OAuth)
Identifies user	✅	❌
Grants access	✅	✅ (with scopes)
Token type	ID Token	Access Token

Use OpenID Connect when you want to log users in and know who they are.

9. Providers That Support OpenID Connect

Provider	Supports OIDC	Discovery Endpoint
Google	✅	`https://accounts.google.com/.well-known/openid-configuration`
Microsoft Azure	✅	`https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration`
Auth0	✅	`https://your-domain.auth0.com/.well-known/openid-configuration`
Okta	✅	`https://{yourOktaDomain}/.well-known/openid-configuration`
Apple	✅	`https://appleid.apple.com/.well-known/openid-configuration`

10. OpenID in Single Sign-On (SSO)

OpenID Connect plays a vital role in enterprise Single Sign-On (SSO) systems.

Example:

Company uses Azure AD as the OpenID Provider
Employees can access Salesforce, Slack, and Jira with a single login
OpenID Connect ensures identity verification, while OAuth enables permission control

11. Security Features

Feature	Description
ID Token Signature	Signed with RSA or HMAC (RS256, HS256)
Nonce	Protects against replay attacks
State	Prevents CSRF attacks
PKCE Support	Mitigates code interception in public clients
Token Expiry	Enforced via `exp` claim

12. Discovery and Dynamic Registration

OIDC supports auto-configuration:

Clients can discover IdP capabilities by querying .well-known/openid-configuration
Clients can dynamically register using a POST to the provider’s registration endpoint

This allows for scalable and decentralized identity federation.

13. Implementation Tools and Libraries

JavaScript:

oidc-client
openid-client

Python:

python-jose
authlib
django-oidc

Java:

Spring Security + OIDC
Keycloak

Identity Platforms:

Okta
Auth0
ForgeRock
Gluu

14. OpenID Connect Flows

Flow Name	Description
Authorization Code Flow	For server-side apps, most secure (with PKCE)
Implicit Flow	For SPAs, now deprecated
Hybrid Flow	Mix of code and token (used in advanced SSO)
Device Authorization Flow	For devices without browsers (e.g., smart TVs)

15. Summary

Topic	Notes
What is it?	Identity layer on OAuth 2.0
Who uses it?	Developers, SaaS apps, enterprises
Why use it?	Federated login and identity validation
Key Components	ID Token, OP, RP, Discovery
Compatible With	OAuth, JWT, MFA, SSO
Security Built-in	Signature, nonce, PKCE, scopes