Openid connect
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
Software Security for Developers
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile information.
- How it is used
- Delegates user authentication to an identity provider for employee SSO, customer applications, social login, and shared application access.
- How deep it goes
- Explains actors, tokens, endpoints, authorization-code steps, identity claims, PKCE, replay protection, and session management.
- Examples
- Uses employee and customer SSO scenarios, an ACME authorization-code flow, endpoint discovery, cURL token exchange, and Spring configuration.
- What you can do after
- Apply it via Spring Security by configuring an OIDC client, executing authorization-code login, and interpreting returned access and ID tokens.
Read how Software Security for Developers explains openid connect →
ASP.NET Core in Action, 3e
OpenID Connect is an authentication protocol built on OAuth 2.0 that adds conventions, discovery, and user-identity authentication to delegated authorization flows.
- How it is used
- Identifies users through an identity provider without requiring each API application to manage their credentials.
- How deep it goes
- Explains OIDC through an OAuth flow and its added identity information, but stops short of a full protocol implementation.
- Examples
- Uses a photo-printing authorization flow, a Backend for Frontend pattern, and Swagger UI authentication to illustrate OIDC’s roles.
- What you can do after
- Evaluate/understand it as a way to delegate user authentication and distinguish identity information from OAuth 2.0 resource access.
Read how ASP.NET Core in Action, 3e explains openid connect →
Effective Platform Engineering
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain standardized identity claims.
- How it is used
- Connects platform login to identity and authorization claims needed for access decisions.
- How deep it goes
- Explains authentication, authorization, IDP configuration, and returned claims, but does not detail an OIDC protocol exchange.
- Examples
- Uses GitHub authentication, team-based control-plane access, and optional Active Directory group synchronization.
- What you can do after
- Apply it via a GitHub OIDC integration to authenticate control-plane users and connect their access to team membership.
Read how Effective Platform Engineering explains openid connect →
Secure APIs
OpenID Connect is an identity layer on top of OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile claims.
- How it is used
- Uses OAuth 2.0 flows to outsource user authentication and connect applications with identity providers.
- How deep it goes
- Explains participants, flow steps, discovery, JWKS validation, and implementation choices; stops short of covering every provider configuration.
- Examples
- Demonstrates Gmail or GitHub login, Auth0 with FastAPI, discovery metadata, authorization codes, JWTs, and JWKS keys.
- What you can do after
- Implement OIDC authentication, integrate a provider, validate its tokens, and authorize API requests safely.
.NET MAUI in Action
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain identity claims.
- How it is used
- Enables a .NET MAUI client to authenticate users and call protected APIs without handling their passwords.
- How deep it goes
- Explains browser login, redirect handling, token exchange, and platform registration, but not identity theory in depth.
- Examples
- Uses a MAUI stock-taking app, IdentityServer, OidcClient, custom redirect schemes, and platform manifest configurations.
- What you can do after
- Build it from scratch by configuring OidcClient, implementing browser authentication, and registering platform callbacks.
Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify a user's identity and obtain basic profile information from an authorization server.
- How it is used
- Authenticates infrastructure delivery workflows and tests to supported vendors without shared service-user credentials.
- How deep it goes
- Walks through provider registration and workflow configuration while deferring protocol details and vendor-specific setup to their documentation.
- Examples
- Uses a Terraform AWS OIDC provider, a GitHub Actions role-assumption workflow, and an Artifactory publishing pipeline.
- What you can do after
- Operate/configure it to authenticate supported delivery and test workflows without storing service-user passwords.
.NET in Action, Second Edition
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identities and obtain basic profile information.
- How it is used
- Delegates user authentication to an identity provider while an ASP.NET Core API handles tokens presented with requests.
- How deep it goes
- Works through provider registration, JWT bearer setup, and Swagger UI sign-in; defers the specification’s broader history.
- Examples
- Uses an Azure AD application registration, a protected API controller, and a Swagger UI request that changes from 401 to 200.
- What you can do after
- Operate/configure it by registering a provider-backed API and authenticating Swagger UI requests to a protected endpoint.
Read how .NET in Action, Second Edition explains openid connect →
Spring Security in Action, Second Edition
oidc is a configuration method that enables OpenID Connect support in an authorization server.
- How it is used
- Enables interoperable authentication support in an OAuth 2 authorization server.
- How deep it goes
- Explains OIDC’s OAuth 2 relationship, added tokens and scopes, actors, flows, and Spring filter-chain configuration.
- Examples
- Uses Spring Security filter chains, oidc(), form login, registered clients, authorization-code grants, and the openid scope.
- What you can do after
- Apply it via Spring Security to enable OIDC endpoints and authenticate users in an authorization server.
Read how Spring Security in Action, Second Edition explains openid connect →
Building Distributed Applications that Work
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile information.
- How it is used
- Uses OIDC to require sign-in for protected online-shop pages through a shared identity provider.
- How deep it goes
- Explains the sign-in flow at a high level and details ASP.NET Core UI configuration, without examining protocol internals.
- Examples
- Shows a Keycloak-backed online-shop UI with cookie and OIDC schemes, request middleware, and an Authorize-protected page.
- What you can do after
- Apply it via Microsoft.AspNetCore.Authentication.OpenIdConnect to redirect unauthenticated ASP.NET Core UI users to an identity provider.
Read how Building Distributed Applications that Work explains openid connect →
Quarkus in Action
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain authentication claims.
- How it is used
- Secures Quarkus REST applications by authenticating users through Keycloak or another OIDC provider.
- How deep it goes
- Demonstrates extension setup, container-backed development, token requests, principal inspection, and test disabling, but not OIDC protocol internals.
- Examples
- Uses a Keycloak container, Dev UI token, Bearer-authenticated curl request, and a whoAmI endpoint returning the principal name.
- What you can do after
- Apply it via Quarkus extensions and Dev Services to authenticate requests and inspect the logged-in user.
GitHub Actions in Action: Continuous integration and delivery for DevOps
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile claims.
- How it is used
- Authenticates GitHub Actions deployment workflows to cloud resources without duplicated long-lived secrets.
- How deep it goes
- Explains trust setup, id-token permissions, JWT exchange, and provider-action YAML while deferring provider-side trust configuration.
- Examples
- Demonstrates Azure login, AWS role assumption and S3 upload, and Google Cloud authentication followed by gcloud commands.
- What you can do after
- Apply it via provider authentication actions to deploy from GitHub Actions using short-lived cloud credentials.
Build Python Web Apps with Streamlit
OpenID Connect is an authentication protocol built on OAuth 2.0 that lets applications verify user identity through an identity provider.
- How it is used
- Deploys third-party identity providers for secure application login without locally storing passwords or password hashes.
- How deep it goes
- Explains the provider setup and Streamlit calls, but stops short of protocol internals.
- Examples
- Uses Google, Microsoft, Okta, or Auth0 with Streamlit login, user inspection, and logout actions.
- What you can do after
- Operate/configure Streamlit authentication with st.login, st.user, st.logout, and provider credentials in st.secrets.
Read how Build Python Web Apps with Streamlit explains openid connect →
Authorization in Action
OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile information from an authorization server.
- How it is used
- Supports interoperable sign-in and identity federation across applications and identity providers.
- How deep it goes
- Defines federation and signed-token propagation, but stops short of solving the broader identity interoperability problem.
- Examples
- Uses Google, Facebook, and Apple sign-in as recognizable federated-login examples.
- What you can do after
- Evaluate identity propagation across systems and distinguish federation from provisioning and directory protocols.
Related concepts
- OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- OpenID Connect ID tokenproduces · An OpenID Connect ID token is a signed token containing claims about an authenticated end user, the authentication event, and the client for which it was issued.
- authenticationimplements · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- single sign-onused by · Single sign-on is an authentication arrangement in which one authentication event enables a user to access multiple applications or services without signing in separately to each.
- Security Assertion Markup Languagealternative to · Security Assertion Markup Language is an XML-based standard for exchanging authentication, identity, and authorization assertions between identity providers and service providers.
- Duende IdentityServerimplemented by · Duende IdentityServer is a .NET framework for implementing identity, authentication, authorization, and token services using established identity protocols.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.