Skip to content
Docs
Theory, Analysis
OIDC

OIDC

This post analyzes OIDC (OpenID Connect).

1. OIDC (OpenID Connect)

[Figure 1] OIDC Component

[Figure 1] OIDC Component

OIDC is an authentication Protocol that performs Authentication based on OAuth 2.0. OIDC is widely used to build SSO (Single Sign On). Since OAuth 2.0 is a Protocol that performs only Authorization, when an authentication system is also needed in an OAuth 2.0 environment, OIDC can be introduced to solve it. [Figure 1] shows the OIDC-related Components when using OIDC in a Web environment.

Since OIDC is based on OAuth 2.0, the Components of OIDC are almost identical to the OAuth 2.0 Components. In OIDC, the component that provides authentication information to the App is called the Identity (OIDC) Provider. From the OAuth 2.0 perspective, the Identity Provider consists of the combination of the Resource Server, which stores the User information required for authentication, and the Authorization Server. Here, the Authorization Server delivers to the App not only authorization information through the Access Token, but also a Token called the ID Token, which stores the User’s information, thereby also serving the role of an authentication Server.

1.1. ID Token

OIDC uses the ID Token to deliver the User’s authentication information to the App. The ID Token is composed of a JWT. Through the JWT, the App can be guaranteed that the ID Token was generated by the Identity Provider and that the contents of the ID Token have not been tampered with. The Signature of the ID Token (JWT) is generally generated with the Identity Provider’s private key. Therefore, verification of the ID Token is performed through the Identity Provider’s public key.

The ID Token generally contains the following Claims.

  • iss (Issuer) : Indicates the issuer of the ID Token.
  • sub (Subject) : Indicates the identifier of the User stored in the ID Token.
  • aud (Audience) : Indicates the entity that receives and uses the ID Token. Generally, the Client ID delivered to the Identity Provider is set in the Audience Claim.
  • exp (Expiration) : Indicates the expiration time of the ID Token.
[Figure 1] OIDC ID Token Issuance Process

[Figure 1] OIDC ID Token Issuance Process

[Figure 1] shows the ID Token issuance process of OIDC. The ID Token issuance process is almost identical to the process of issuing an Access Token in OAuth 2.0. The only difference is that in the last step 12, an ID Token is delivered to the App from the Authorization Server instead of an Access Token. If necessary, the App can also receive not only the ID Token but also the OAuth 2.0 Access Token and Refresh Token together.

2. References

Object, Class, InstanceOLTP, OLAP