OpenID Connect (OIDC) (2024)

What is OIDC?

OpenID Connect (OIDC) is an open authentication protocol that works on top of the OAuth 2.0 framework. Targeted toward consumers, OIDC allows individuals to use single sign-on (SSO) to access relying party sites using OpenID Providers (OPs), such as an email provider or social network, to authenticate their identities. It provides the application or service with information about the user, the context of their authentication, and access to their profile information.

The purpose of OIDC is for users to provide one set of credentials and access multiple sites. Each time users sign on to an application or service using OIDC, they are redirected to their OP, where they authenticate and are then redirected back to the application or service.

OIDC is one of the newest security protocols and was designed to protect browser-based applications, APIs, and mobile native applications. It delegates user authentication to the service provider that hosts the user account and authorizes third-party applications to access the user’s account.

OIDC example

For example, there are currently two ways of creating a Spotify account. You can register with Spotify or you can sign on through Facebook. Facebook sends your name and email address to Spotify, which uses that information to authenticate you.

What are the benefits of SSO?

No more managing passwords

SSO not only increases employee productivity by reducing the time they must spend signing on and dealing with passwords, but it also improves the customer experience. It’s known that many customers abandon their carts because of forgotten passwords. SSO creates a more seamless experience with less frustration, which results in customer loyalty, higher conversion rates, and enhanced brand visibility.

Higher security

SSO also significantly decreases the likelihood of a password-related hack. With SSO, users only need to remember a single password for all their applications and are less likely to reuse passwords or write them down, which reduces the risk of theft. Easy access is particularly valuable for employees that are in the field or working from multiple devices.

Improved user experience

Using SSO can decrease IT costs by reducing the number of required passwords to just one, and can also be used to strengthen B2B partnerships. Using federated SSO (or federated identity management) can help separate organizations and third parties, such as application vendors or partners, share identities and authenticate users across domains. When two domains are federated, a user can authenticate to one domain and then access resources in the other domain without having to sign on again.

How does OIDC work?

OIDC is similar to OAuth where users give one application permission to access data in another application without having to provide their usernames and passwords. Instead, tokens are used to complete both authentication and authorization processes:

• Identity tokens, intended to be read by the client, prove that users were authenticated and are JSON Web Tokens (JWTs), pronounced “jots.” These files contain information about the user, such as their usernames, when they attempted to sign on to the application or service, and the length of time they are allowed to access the online resources.
• Access tokens are used to access protected resources, which are intended to be read and validated by the API. These tokens can be JWTs, but might be in a different format. Their purpose is to inform the API that the bearer of this token has been authorized to access the API and perform specific actions (as specified by the scope that has been granted).

ID tokens cannot be used for API access purposes and access tokens cannot be used for authentication. The following diagram shows how a typical OIDC authentication process works.

Differences between SAML, OAuth, OpenID Connect

The primary difference between these standards is that OAuth, now known as OAuth 2.0, is an authorization framework used to protect specific resources, such as applications or sets of files, while SAML and OIDC are authentication protocols used to create secure sign-on experiences. SAML and OIDC are about who someone is, where OAuth is about what they are allowed to do.

OpenID Connect vs OAuth

OAuth, now known as OAuth 2.0, is an open standard framework for API authorization. It defines how an API client can obtain security tokens that contain a set of permissions against the resources available through that API.

Instead of requiring a user to share login credentials with one application to give that application access to another, OAuth delegates authorization decisions to a separate authorization server that hosts the user account. Essentially, OAuth acts on behalf of the user, providing delegated access to a third-party service without the user exposing their credentials to that third party.

The primary difference between OpenID Connect and OAuth is that OAuth is an authorization framework used to protect specific resources, such as applications or sets of files, while SAML and OIDC are authentication standards used to create secure sign-on experiences.

What is the difference between SAML and OIDC?

SAML and OIDC are both powerful authentication protocols used to create secure sign-on experiences, but are used for different purposes.

• SAML is an older standard and more widely adopted in enterprises that use web-based applications, while OIDC is newer and gaining traction with mobile and native applications.
• SAML is used to access browser-based applications and does not support SSO for mobile devices or provide API access. OAuth provides API access and OIDC provides access to APIs, mobile native applications, and browser-based applications.
• OIDC uses a public, third-party IdP to authenticate users. Examples of IdPs that support OIDC include Google, Microsoft, and Amazon. With OIDC, a user can gain access to an application by signing on with a trusted, OIDC-compatible account.
• For large enterprises that require a higher level of security, SAML might be the better choice. SAML allows multi-factor authentication, is feature-rich, and has been a staple for enterprise security for more than a decade.
• SAML is known for its flexibility, but most developers find OIDC easier to use because it is less complicated.
• SAML uses tokens written in XML and OIDC uses JWTs, which are portable and support a range of signature and encryption algorithms.

Additional differences include:

• SAML is known for its flexibility, but most developers find OIDC easier to use because it is less complex.
• SAML is used to access browser-based applications and does not support SSO for mobile devices or provide API access. OAuth provides API access and OIDC provides access to APIs, mobile native applications, and browser-based applications.
• OIDC is about who someone is. OAuth 2.0 is about what they are allowed to do.
• SAML uses tokens written in XML and OIDC uses JWTs, which are portable and support a range of signature and encryption algorithms.

Benefits of OIDC for Developers

OIDC is one of the newest security standards available and is used by developers who support mobile applications, APIs, and browser-based applications. Other benefits include:

No More Managing Passwords

Since tokens are used to complete the authentication and authorization processes instead of usernames and passwords, developers are no longer responsible for setting, storing, and managing passwords, which is often the cause of credential-based data breaches.

Higher Security

Using tokens makes it a highly secure protocol. Not only are user credentials not shared, but it also makes it possible for users to sign on to multiple applications without having to create separate usernames and passwords for each, which can easily be compromised.

Ease of Implementation

OIDC is an open standard, decentralized authentication protocol that allows websites and authentication services to securely exchange information in a standardized way.