Openid connect

As explained in Effective Platform Engineering

OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain standardized identity claims.

OpenID Connect (OIDC) is an identity layer built on OAuth 2.0. In an engineering platform, an OIDC integration lets users log in through an identity provider (IDP) while the platform receives the identity and authorization claims it needs to make access decisions. Authentication establishes who the user is; authorization determines what that user may do. section 4.3.3

The IDP need not be the source of truth for every attribute it returns. Configure its authorization server to consult the platform’s authorization data and include relevant claims after a successful login. This keeps identity verification and access decisions connected without requiring every platform component to manage users independently. section 4.3.3

For a platform integration, settle these choices before adding more access points:

• Choose where users authenticate and where team membership is authoritative; they need not be the same system. section 8.5
• Configure the IDP to return the authorization claims the platform needs, rather than treating a successful login as sufficient access. section 4.3.3
• Favor systems whose authorization configuration can be automated. Ticket-driven role assignment adds friction to the developer experience. section 4.3.3

GitHub-backed control-plane access

A developer authenticates through GitHub using an OIDC integration. GitHub teams supply team membership for authorization, and a ClusterRoleBinding grants the platform-building team access to the control plane. An organization could instead synchronize Active Directory groups into GitHub groups, making Active Directory the place where membership changes. Either way, the platform must decide which teams are its customers before it can automate their namespaces and RoleBindings. section 8.5

Figure 4.8 We want the IDP to be the go-between rather than the source of truth, and we will need to be able to customize the results from the authorization service.

The diagram reinforces the IDP’s role as a go-between: configure what the authorization service returns instead of assuming the IDP owns the underlying data. section 4.3.3

How Effective Platform Engineering covers it

How deep it goes

Explains authentication, authorization, IDP configuration, and returned claims, but does not detail an OIDC protocol exchange.

Examples

Uses GitHub authentication, team-based control-plane access, and optional Active Directory group synchronization.

What it assumes

Assumes familiarity with platform access systems while defining identity, authentication, and authorization explicitly.

What you can do after

Apply it via a GitHub OIDC integration to authenticate control-plane users and connect their access to team membership.

How it connects

Ties OIDC to identity providers, authorization claims, GitHub teams, Active Directory groups, and Kubernetes RoleBindings.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile information.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eOpenID Connect is an authentication protocol built on OAuth 2.0 that adds conventions, discovery, and user-identity authentication to delegated authorization flows.
• 

  liveBookmanning.com
  Secure APIsOpenID Connect is an identity layer on top of OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile claims.
• 

  liveBookmanning.com
  .NET MAUI in ActionOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain identity claims.
• 

  liveBookmanning.com
  Terraform in Depth: Infrastructure as Code with Terraform and OpenTofuOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify a user's identity and obtain basic profile information from an authorization server.
• 

  liveBookmanning.com
  .NET in Action, Second EditionOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identities and obtain basic profile information.
• 

  liveBookmanning.com
  Spring Security in Action, Second Editionoidc is a configuration method that enables OpenID Connect support in an authorization server.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile information.
• 

  liveBookmanning.com
  Quarkus in ActionOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain authentication claims.
• 

  liveBookmanning.com
  GitHub Actions in Action: Continuous integration and delivery for DevOpsOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile claims.
• 

  liveBookmanning.com
  Build Python Web Apps with StreamlitOpenID Connect is an authentication protocol built on OAuth 2.0 that lets applications verify user identity through an identity provider.
• 

  liveBookmanning.com
  Authorization in ActionOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile information from an authorization server.

Compare how 13 books explain openid connect →

Related concepts

• OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• OpenID Connect ID tokenproduces · An OpenID Connect ID token is a signed token containing claims about an authenticated end user, the authentication event, and the client for which it was issued.
• authenticationimplements · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• single sign-onused by · Single sign-on is an authentication arrangement in which one authentication event enables a user to access multiple applications or services without signing in separately to each.
• Security Assertion Markup Languagealternative to · Security Assertion Markup Language is an XML-based standard for exchanging authentication, identity, and authorization assertions between identity providers and service providers.
• Duende IdentityServerimplemented by · Duende IdentityServer is a .NET framework for implementing identity, authentication, authorization, and token services using established identity protocols.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.