←  All terms
O
Security & Compliance

OpenID Connect

OpenID Connect adds a standardized identity layer to OAuth 2.0 for sign-in and user information.

OpenID Connect adds a standardized identity layer to OAuth 2.0 for sign-in and user information. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to OAuth and Single Sign-On.

Read more

OAuth

Single Sign-On

SAML

Authentication

FAQ

OpenID Connect

Which mistakes are common with OpenID Connect?
ID tokens are often not fully validated, redirect URIs are approved too generously, or more user data than necessary is requested. Access tokens and ID tokens also get confused. A vetted library and a configuration review reduce these risks; the scope of data and its legal basis should be assessed from a privacy perspective.
What is an ID token in OpenID Connect?
An ID token is a signed token confirming who signed in with which provider and when. The application must verify signature, issuer, and validity before trusting the claims. It serves sign-in; for access to APIs, a separate access token is used instead.
What is the difference between OpenID Connect and SAML?
Both enable single sign-on through an identity provider. SAML uses XML and is widespread in enterprise environments, while OpenID Connect uses JSON-based tokens on top of OAuth 2.0 and fits modern web and mobile applications better. What the existing systems support often decides.
What is OpenID Connect used for in practice?
Mainly for sign-in through a central identity provider: single sign-on for employees, login with an existing account, or unified authentication across several applications. The application receives an ID token with verified identity claims. Managing passwords itself is no longer necessary, while dependence on the identity provider grows.