What is OpenID Connect (OIDC)?

What is OpenID Connect (OIDC)?#

OpenID Connect (OIDC) is a modern authentication protocol built on top of the OAuth 2.0 framework. It allows clients to verify the identity of end-users based on the authentication performed by an authorization server, and to obtain basic profile information about the end-users in an interoperable manner. Here's a brief breakdown:

• OAuth vs. OIDC: While OAuth provides authorization, OIDC introduces identity layer on top, making user authentication seamless and more secure.
• Components: OIDC utilizes ID Tokens, which are JSON web tokens (JWT) that contain information (or claims) about the user session.
• Usage: Primarily used for user authentication in modern web applications and mobile apps.

Key Takeaways#

---

OpenID Connect, often referred to as OIDC, emerged as a third-party login standard. Building on the authorization capabilities of OAuth 2.0, OIDC adds an identity layer that allows for the verification of the identity of users and the ability to get detailed user information.

Understanding the Basics#

• OAuth: Before diving into OIDC, it's crucial to understand OAuth. OAuth 2.0 is a protocol that allows apps to access user data without exposing user passwords. It's about granting permissions without direct credentials.
• ID Token: A significant addition in OIDC is the ID Token, a JWT containing claims about the authenticated user, such as user's name, email, and other profile details.

Benefits of OIDC#

• Enhanced Security: OIDC offers a more robust security model, ensuring that only authenticated users access apps or systems.
• Interoperability: Given its standardized nature, OIDC can be implemented across a variety of applications and platforms without compatibility issues.
• User Experience: By allowing third-party logins (like 'Login with Google'), OIDC offers users a simplified and consistent login experience.

OIDC and OAuth#

While both OIDC and OAuth can function independently, their combined capabilities offer a comprehensive solution. OAuth handles the authorization part, ensuring apps have the correct permissions, whereas OIDC takes care of user authentication, verifying the user's identity.

---

OpenID Connect (OIDC) FAQs#

How does OIDC differ from OAuth?#

• While both are closely related, OIDC is specifically designed for user authentication, whereas OAuth is for authorization. OIDC provides apps with a user's identity while maintaining the user's privacy.

Is OIDC a replacement for OAuth?#

• No, OIDC is not a replacement. Instead, it's an extension built on top of OAuth 2.0, adding an identity layer for user authentication.

How secure is OIDC for user authentication?#

• OIDC provides a robust and secure method for user authentication, especially when used in conjunction with other security practices and protocols.

Can I use OIDC without OAuth?#

• While technically possible, OIDC is typically layered on top of OAuth to provide a complete solution for both authentication and authorization.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →