An identity provider (IdP) manages user identities, authenticates users, and issues identity or authorization artifacts to client applications. OpenID Connect (OIDC) lets an application outsource login while receiving an ID token and, optionally, an access token. section 7.6
A typical OIDC integration works like this:
- Register the relying-party application with the IdP. section 7.6
- Redirect the user to the authorization endpoint with the client ID and openid scope. section 7.6 section 8.7
- Receive an authorization code, exchange it for tokens, and validate access tokens on every request. section 8.7
- Use discovery metadata and the JWKS endpoint to locate keys and verify token signatures; constrain the accepted signing algorithm. section 8.7
Logging in with an external identity
A website can let users sign in with Gmail or GitHub. The site redirects them to the provider, receives an ID token after consent, and may use an access token for authorized requests. section 7.6
Figure 7.14 OIDC allows applications to use OPs to manage their user identities securely. In this case, the application redirects the user to the OIDC server to log in and give consent, and it obtains an ID token and an access token in return.
Follow the redirect, consent, and token exchange visually. section 7.6
