OpenID Connect (OIDC) Interview Questions and Answers (15 Must-Know Questions)

Master OpenID Connect (OIDC) with 15 interview questions and answers. Learn OIDC architecture, ID Token, UserInfo endpoint, Discovery, Authentication Flow, OAuth2 vs OIDC, Spring Security implementation, production use cases, common mistakes, and best practices.

Introduction

OpenID Connect (OIDC) is an identity layer built on top of OAuth2. While OAuth2 provides authorization, OpenID Connect adds authentication, allowing applications to verify a user's identity and obtain basic profile information securely.

Today, OpenID Connect is the de facto standard for Single Sign-On (SSO) across web applications, mobile applications, cloud platforms, enterprise portals, and APIs. Identity providers such as Google, Microsoft Entra ID (Azure AD), Okta, Auth0, Keycloak, Ping Identity, Amazon Cognito, and IBM Security Verify support OpenID Connect.

This guide covers the 15 most important OpenID Connect interview questions with architecture diagrams, authentication flows, Spring Boot examples, enterprise use cases, common mistakes, and production best practices.

What You'll Learn

What is OpenID Connect?
OAuth2 vs OIDC
Authentication Flow
ID Token
Access Token
UserInfo Endpoint
Discovery Endpoint
OpenID Scopes
Single Sign-On (SSO)
Spring Security Integration
Enterprise Architecture
Best Practices

OpenID Connect Architecture

flowchart TD
    U["User"] --> CA["Client Application"]
    CA --> IDP["Identity Provider (OIDC)\nAuthentication + Token Issue"]
    IDP --> IDT["ID Token"]
    IDP --> AT["Access Token"]
    IDT --> UA["User Authentication"]
    AT --> PA["Protected APIs"]

Authentication Flow

sequenceDiagram
    participant U as User
    participant APP as Application
    participant IDP as Identity Provider
    U->>APP: Initiate Login
    APP->>IDP: Authorization Request
    IDP->>U: Login Page
    U->>IDP: Enter Credentials
    IDP->>APP: Authorization Code
    APP->>IDP: Exchange Code
    IDP->>APP: Access Token + ID Token
    APP->>APP: Validate ID Token
    APP->>APP: Access Protected APIs

1. What is OpenID Connect (OIDC)?

Answer

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth2.

It enables applications to:

Authenticate users
Obtain user identity
Support Single Sign-On (SSO)
Retrieve user profile information

Unlike OAuth2, OIDC tells applications who the user is.

2. Why was OpenID Connect introduced?

Answer

OAuth2 only answers:

Can this application access the resource?

OIDC answers:

Who is the logged-in user?

It introduces:

ID Token
UserInfo Endpoint
Discovery Endpoint
Standard user claims

3. What is the difference between OAuth2 and OpenID Connect?

Answer

OAuth2	OpenID Connect
Authorization	Authentication + Authorization
Access Token	Access Token + ID Token
API Access	User Identity
Resource Server	Identity Provider
No User Identity	Provides User Identity

4. What is an ID Token?

Answer

An ID Token is a JWT that contains authenticated user information.

Typical claims:

{
  "sub":"123456",
  "name":"Venugopal",
  "email":"[email protected]",
  "iss":"https://login.company.com",
  "aud":"client-app",
  "exp":1789000000
}

Common Claims

sub
name
email
picture
iss
aud
exp
iat
nonce

5. What is the difference between ID Token and Access Token?

Answer

ID Token	Access Token
Authentication	Authorization
Used by Client	Used by APIs
Contains User Identity	Contains Permissions
JWT	JWT or Opaque

Never send an ID Token to backend APIs.

6. What is the UserInfo Endpoint?

Answer

The UserInfo Endpoint returns additional authenticated user information.

Example:

GET /userinfo
Authorization: Bearer access_token

Response

{
  "sub":"12345",
  "name":"John Smith",
  "email":"[email protected]"
}

7. What is the Discovery Endpoint?

Answer

OIDC provides automatic configuration using:

/.well-known/openid-configuration

It returns:

Authorization endpoint
Token endpoint
UserInfo endpoint
JWKS endpoint
Supported scopes
Supported algorithms

This eliminates hardcoding endpoints.

8. What are OIDC Scopes?

Answer

Scopes determine which user information can be accessed.

Common scopes:

openid
profile
email
phone
address
offline_access

Example

scope=openid profile email

The openid scope is mandatory.

9. What is Single Sign-On (SSO)?

Answer

Single Sign-On allows users to authenticate once and access multiple applications.

Architecture

            User
              │
              ▼
       Identity Provider
      (Google / Okta / Azure)
              │
     ┌────────┼────────┐
     ▼        ▼        ▼
   App A    App B    App C

Benefits

Better user experience
Central authentication
Reduced password management
Improved security

10. How does OpenID Connect Authentication Flow work?

Answer

Production Flow

User

↓

Client Application

↓

Authorization Endpoint

↓

Login

↓

Authorization Code

↓

Token Endpoint

↓

Access Token

+

ID Token

↓

Application

↓

Protected APIs

11. How is OpenID Connect implemented in Spring Boot?

Answer

Dependency

<dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>
 spring-boot-starter-oauth2-client
 </artifactId>
</dependency>

Configuration

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: your-client-id
            client-secret: your-secret

Spring Security automatically manages the login flow.

12. What are common enterprise use cases?

Answer

OIDC is widely used for:

Google Login
Microsoft Login
GitHub Login
Okta Login
Banking portals
Healthcare systems
Employee portals
Customer portals
Cloud applications

13. What are common OpenID Connect mistakes?

Answer

Common mistakes include:

Using ID Token for API authorization
Not validating token signature
Ignoring issuer validation
Ignoring audience validation
Skipping nonce validation
Logging tokens
Missing HTTPS
Long-lived sessions
Not rotating keys
Trusting client-side validation

14. What are OpenID Connect Best Practices?

Answer

Recommended practices:

Always use HTTPS
Validate issuer
Validate audience
Validate expiration
Validate nonce
Validate signature
Use Authorization Code + PKCE
Rotate signing keys
Keep ID Tokens short-lived
Store tokens securely

15. How does OpenID Connect work in Enterprise Architecture?

Answer

                Users
                  │
                  ▼
          Web / Mobile Apps
                  │
                  ▼
         Identity Provider (OIDC)
                  │
       +----------+-----------+
       |                      |
       ▼                      ▼
   ID Token            Access Token
       |                      |
       ▼                      ▼
Authentication         API Gateway
                              │
                              ▼
                     Microservices
                              │
                              ▼
                          Database

Enterprise Components

Identity Provider
Authorization Server
User Authentication
JWT Validation
API Gateway
Resource Server
Monitoring
Logging

OpenID Connect Summary

Concept	Description
OIDC	Authentication protocol
OAuth2	Authorization framework
ID Token	User identity
Access Token	API authorization
UserInfo Endpoint	User profile
Discovery Endpoint	Automatic configuration
SSO	Single Sign-On
PKCE	Secure public clients
Identity Provider	Authenticates users
Spring Security	OIDC integration

Interview Tips

Explain that OIDC is built on top of OAuth2.
Clearly differentiate Authentication and Authorization.
Explain the purpose of the ID Token.
Never confuse ID Token with Access Token.
Mention the UserInfo Endpoint.
Explain the Discovery Endpoint.
Discuss Single Sign-On architecture.
Mention Authorization Code Flow with PKCE.
Explain token validation (issuer, audience, expiration, signature).
Use enterprise examples such as Google, Microsoft Entra ID, Okta, and Keycloak.

Key Takeaways

OpenID Connect is an authentication protocol built on OAuth2.
OAuth2 authorizes applications, while OIDC authenticates users.
The ID Token is a JWT containing authenticated user identity information.
The Access Token is used to access protected APIs.
The UserInfo Endpoint provides additional user profile information.
The Discovery Endpoint enables automatic client configuration.
OpenID Connect is the foundation of modern Single Sign-On (SSO).
Authorization Code Flow with PKCE is the recommended authentication flow.
Spring Security provides first-class support for OpenID Connect.
OpenID Connect is widely used in enterprise applications, cloud platforms, banking systems, healthcare, and modern microservices.