OpenID Connect Reference
Reference 为 OpenID Connect (OIDC): identity 层开 OAuth 2.0 具有 ID tokens 和 userinfo.
OIDC Concepts
OpenID Connect extends OAuth 2.0 with authentication (identity) on top of authorization. The ID Token is a JWT containing user identity claims (sub, email, name). The UserInfo endpoint returns user profile data. Discovery (.well-known/openid-configuration) provides endpoint URLs and capabilities. The nonce prevents replay attacks. OIDC flows: Authorization Code (with PKCE), Implicit (deprecated), Hybrid. The sub claim is the stable subject identifier.
- ID Token
- JWT with identity
- UserInfo
- Profile endpoint
- discovery
- .well-known config
sub, email, nameuser dataendpoints + capsClaims and Validation
Standard claims: sub (subject), iss (issuer), aud (audience), exp, iat, nonce, auth_time. Validate ID Token signature, issuer, audience, expiry, and nonce. Request specific claims via scope (openid profile email) or claims parameter. Pairwise pseudonymous identifiers (PPID) prevent cross-RP tracking. Back-channel logout enables server-side session termination. CIBA (Client-Initiated Backchannel Authentication) decouples authentication from the redirect flow. FAPI (Financial API) defines strict security profiles.
- sub
- Stable subject ID
- nonce
- Replay prevention
- PPID
- Per-RP pseudonymous
unique per issuervalidate in ID tokenanti-tracking