OAuth and OIDC

  1. OpenID Connect Identity Layer
    1. OIDC Foundation
      1. Building on OAuth 2.0
        1. Authentication vs Authorization
          1. Identity Protocol Requirements
          2. Core OIDC Concepts
            1. Identity Tokens
              1. Claims-Based Identity
                1. UserInfo Endpoint
                  1. Identity Provider Role
                  2. ID Token
                    1. Purpose and Function
                      1. Authentication Assertion
                        1. Identity Information
                          1. Security Properties
                          2. JWT Structure
                            1. Header Components
                              1. Payload Claims
                                1. Signature Verification
                                2. Standard Claims
                                  1. Issuer Claim
                                    1. Subject Identifier
                                      1. Audience Claim
                                        1. Expiration Time
                                          1. Issued At Time
                                            1. Authentication Time
                                              1. Nonce Claim
                                                1. Authentication Context Class Reference
                                                2. Custom Claims
                                                  1. Application-Specific Information
                                                    1. Privacy Considerations
                                                    2. Token Validation
                                                      1. Signature Verification
                                                        1. Claim Validation
                                                          1. Nonce Verification
                                                            1. Time-Based Validation
                                                          2. OIDC Flows
                                                            1. Authorization Code Flow with OIDC
                                                              1. Standard OAuth Flow Extension
                                                                1. ID Token Inclusion
                                                                  1. Security Benefits
                                                                  2. Implicit Flow with OIDC
                                                                    1. Direct Token Delivery
                                                                      1. Use Cases
                                                                        1. Security Limitations
                                                                        2. Hybrid Flow
                                                                          1. Mixed Token Delivery
                                                                            1. Front-Channel and Back-Channel
                                                                              1. Security Properties
                                                                                1. Use Cases
                                                                              2. UserInfo Endpoint
                                                                                1. Purpose and Function
                                                                                  1. Access Token Requirements
                                                                                    1. Claim Retrieval
                                                                                      1. Privacy Considerations
                                                                                      2. Claims and Scopes
                                                                                        1. Standard Claim Types
                                                                                          1. Profile Claims
                                                                                            1. Email Claims
                                                                                              1. Address Claims
                                                                                                1. Phone Claims
                                                                                                2. Scope-to-Claims Mapping
                                                                                                  1. Claim Request Methods
                                                                                                    1. Voluntary vs Essential Claims

                                                                                                  Previous

                                                                                                  6. OAuth 2.0 Authorization Grants

                                                                                                  Go to top

                                                                                                  Next

                                                                                                  8. JSON Web Tokens in OAuth and OIDC