OpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a signed ID token. OIDC is the modern default for federated sign-in.
OIDC is the default for new applications because it fits how software is actually built now: JSON, JWTs, mobile apps, and APIs, rather than XML posted through a browser form. SAML persists where the enterprise on the other side requires it, which is most large B2B deals, so real-world stacks support both. The discovery document is the practical superpower, letting a client self-configure from one URL.
See also: OpenID Connect, ID token, SAML vs OIDC, add login to Next.js recipe
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryJWKS
JSON Web Key Set. A published set of public keys an issuer uses to sign tokens, letting relying parties verify JWT signatures and handle key rotation. The JWKS
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature