OpenID Connect ID token

As explained in Secure APIs

An ID token is a token issued by an identity provider that conveys claims about an authenticated user or authentication event to a client.

An ID token is a signed token from an identity provider that carries claims about an authenticated human, such as name, email, birth date, or identifier. It identifies the user; it does not prove permission to call an API. Use an access token to authorize operations and resource access. section 7.2.1

Figure 7.14 OIDC allows applications to use OPs to manage their user identities securely. In this case, the application redirects the user to the OIDC server to log in and give consent, and it obtains an ID token and an access token in return.

OIDC redirects the user to an identity provider for authentication and consent, then returns an ID token and optionally an access token. section 7.6

A typical OpenID Connect flow works as follows:

• Redirect the user to the identity provider with a registered client ID and the openid scope. section 7.6
• After login and consent, receive the ID token and, when requested, an access token. section 7.6
• Use the ID token to establish user identity and the access token to authorize resource-server requests. section 7.2.1

Signing in with an external identity

A website can let someone sign in with Gmail or GitHub. The website, registered as the relying party, receives claims about the authenticated user; an access token, if issued, is used for API access. section 7.6

How Secure APIs covers it

How deep it goes

Defines claims, distinguishes token roles, and sketches the OIDC flow without detailing token validation internals.

Examples

Uses Gmail or GitHub sign-in and an identity-provider redirect returning ID and optional access tokens.

What it assumes

Builds from zero on OIDC participants and flow while assuming only the OAuth 2.0 foundation on which OIDC relies.

What you can do after

Evaluate identity and authorization designs by keeping user identification in ID tokens and API permissions in access tokens.

How it connects

Connects OpenID Connect with OAuth 2.0, identity providers, relying parties, access tokens, and API authorization.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersAn ID token is an OpenID Connect JWT containing claims about the authenticated end user and the authentication event.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eAn ID token is an OpenID Connect token that describes a user authentication event and may contain claims about the authenticated user.

Compare how 3 books explain OpenID Connect ID token →

Related concepts

• JSON Web Tokenkind of · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
• openid connectproduced by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• API keycontrasts with · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• tokenkind of · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
• bearer authenticationkind of · Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.