OAuth and OIDC

7.

OpenID Connect Identity Layer

7.1.

OIDC Foundation

7.1.1.

Building on OAuth 2.0

7.1.2.

Authentication vs Authorization

7.1.3.

Identity Protocol Requirements

7.2.

Core OIDC Concepts

7.2.1.

Identity Tokens

7.2.2.

Claims-Based Identity

7.2.3.

UserInfo Endpoint

7.2.4.

Identity Provider Role

7.3.

7.3.1.

Purpose and Function

7.3.1.1.

Authentication Assertion

7.3.1.2.

Identity Information

7.3.1.3.

Security Properties

7.3.2.

7.3.2.1.

Header Components

7.3.2.2.

7.3.2.3.

Signature Verification

7.3.3.

Standard Claims

7.3.3.1.

7.3.3.2.

Subject Identifier

7.3.3.3.

7.3.3.4.

Expiration Time

7.3.3.5.

7.3.3.6.

Authentication Time

7.3.3.7.

7.3.3.8.

Authentication Context Class Reference

7.3.4.

7.3.4.1.

Application-Specific Information

7.3.4.2.

Privacy Considerations

7.3.5.

Token Validation

7.3.5.1.

Signature Verification

7.3.5.2.

Claim Validation

7.3.5.3.

Nonce Verification

7.3.5.4.

Time-Based Validation

7.4.

7.4.1.

Authorization Code Flow with OIDC

7.4.1.1.

Standard OAuth Flow Extension

7.4.1.2.

ID Token Inclusion

7.4.1.3.

Security Benefits

7.4.2.

Implicit Flow with OIDC

7.4.2.1.

Direct Token Delivery

7.4.2.2.

7.4.2.3.

Security Limitations

7.4.3.

7.4.3.1.

Mixed Token Delivery

7.4.3.2.

Front-Channel and Back-Channel

7.4.3.3.

Security Properties

7.4.3.4.

7.5.

UserInfo Endpoint

7.5.1.

Purpose and Function

7.5.2.

Access Token Requirements

7.5.3.

Claim Retrieval

7.5.4.

Privacy Considerations

7.6.

Claims and Scopes

7.6.1.

Standard Claim Types

7.6.1.1.

7.6.1.2.

7.6.1.3.

7.6.1.4.

7.6.2.

Scope-to-Claims Mapping

7.6.3.

Claim Request Methods

7.6.4.

Voluntary vs Essential Claims

Previous

6. OAuth 2.0 Authorization Grants

Go to top

Next

8. JSON Web Tokens in OAuth and OIDC