OpenID Connect provider

As explained in Secure APIs

An OpenID Provider is an identity provider that authenticates users and issues OpenID Connect tokens to relying parties.

An OpenID Provider (OP) is an identity provider that manages user identities, authenticates users, and issues OpenID Connect tokens to relying-party applications. It lets an application outsource login to services such as Google, GitHub, Auth0, Okta, Microsoft Entra, or AWS Cognito. section 7.6

An OIDC authentication flow connects three parties:

• The relying party registers with the OP and redirects the user to its authentication endpoint. section 7.6
• The user authenticates with the OP and grants consent. section 7.6
• The OP returns an ID token and optionally an access token; the application uses the access token for authorized requests. section 7.6

Figure 7.14 OIDC allows applications to use OPs to manage their user identities securely. In this case, the application redirects the user to the OIDC server to log in and give consent, and it obtains an ID token and an access token in return.

Follow the flow from application redirect through user login and consent to token issuance. section 7.6

How Secure APIs covers it

How deep it goes

Defines the parties and walks through authentication, consent, token issuance, and access-token use.

Examples

Uses Gmail and GitHub login alongside Auth0, Okta, Microsoft Entra, AWS Cognito, Curity, and Authlete.

What it assumes

Builds on OAuth 2.0 concepts while identifying OIDC-specific parties, scopes, consent, and ID tokens.

What you can do after

Apply OIDC to integrate outsourced user authentication and receive identity and authorization tokens.

How it connects

Connects OAuth 2.0, identity providers, relying parties, users, ID tokens, and access tokens.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• Keycloakimplemented by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.
• OIDC discoveryconfigured by · OIDC discovery is a standard data structure and endpoint convention for publishing an OpenID Provider’s configuration and capabilities.
• quarkus-oidcused by · quarkus-oidc is a Quarkus extension that integrates OpenID Connect authentication into Quarkus applications.
• identity providerkind of · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
• identity as a serviceimplemented by · Identity as a service is a hosted identity-management capability that provides functions such as authentication, identity storage, and access federation.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.