OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0. It lets an application verify a user's identity through an external identity provider instead of managing authentication itself. section 7.6 section 7.8
OIDC separates the participants clearly: the OpenID Provider authenticates users, the relying party is the client application, and the user is the identity being verified. A successful flow returns an ID token and may also return an access token. section 7.6
A typical OIDC authorization-code flow works as follows:
- Redirect the user to the provider with the client identifier and the openid scope. section 7.6
- Let the user authenticate and consent to sharing identity information. section 7.6
- Receive an authorization code, exchange it for tokens, and use the access token for API authorization. section 8.7
- Validate access tokens on every request, including their claims and signature, before authorizing the operation. section 8.7
Adding OIDC to an API
A FastAPI service can integrate with Auth0 by registering an authorization-code client, redirecting users to Auth0, and validating the resulting JWT access tokens. The provider's discovery endpoint, /.well-known/openid-configuration, supplies integration metadata. Its JWKS endpoint supplies public keys; the token's kid header identifies the key used to validate the signature. Prefer a managed IDaaS provider or a standard self-hosted implementation such as Keycloak rather than building identity management from scratch. section 8.4 section 8.7
Figure 7.14 OIDC allows applications to use OPs to manage their user identities securely. In this case, the application redirects the user to the OIDC server to log in and give consent, and it obtains an ID token and an access token in return.
Use the flow diagram to trace the redirect to the provider, user consent, and return of the ID token and optional access token. section 7.6
