---

Introduction

OAuth2 is designed for authorization, but it does not define how an application verifies the identity of a user.

To solve this problem, OpenID Connect (OIDC) was introduced.

OpenID Connect is an identity layer built on top of OAuth2.

It enables applications to authenticate users and retrieve their identity information securely.

Today, OIDC powers authentication for millions of applications using providers such as

• Google
• Microsoft Azure AD
• Okta
• Auth0
• Keycloak
• Amazon Cognito

Spring Security has first-class support for OpenID Connect.

---

OpenID Connect Architecture

flowchart LR

User --> ClientApplication

ClientApplication --> OpenIDProvider

OpenIDProvider --> IDToken

OpenIDProvider --> AccessToken

AccessToken --> ResourceServer

IDToken --> ClientApplication

ClientApplication --> User

---

Q1. What is OpenID Connect (OIDC)?

Answer

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth2.

It allows applications to

• Authenticate users
• Obtain identity information
• Support Single Sign-On (SSO)
• Retrieve user profile information

Unlike OAuth2,

OIDC answers the question:

Who is the user?

---

Q2. Why do we need OpenID Connect?

OAuth2 only grants access to resources.

It does not define

• User identity
• Login process
• User profile retrieval

OIDC adds

• ID Token
• UserInfo Endpoint
• Standard identity claims
• Discovery Endpoint

making authentication interoperable.

---

Q3. What is an ID Token?

An ID Token is a JWT containing authenticated user information.

Example claims

{
  "sub": "12345",
  "name": "Venugopal",
  "email": "[email protected]",
  "iss": "https://accounts.google.com"
}

The client validates the ID Token to confirm the user's identity.

---

Q4. What is the difference between an ID Token and an Access Token?

ID Token	Access Token
Used for authentication	Used for authorization
Intended for the client	Sent to Resource Server
Contains identity claims	Grants API access
JWT in OIDC	Format depends on provider

The ID Token proves who the user is, while the Access Token determines what APIs the client can access.

---

Q5. What is the UserInfo Endpoint?

The UserInfo Endpoint returns additional profile information about the authenticated user.

Typical information

• Name
• Email
• Phone Number
• Profile Picture
• Locale

The client calls this endpoint using the Access Token.

---

Q6. What is the Discovery Endpoint?

The Discovery Endpoint provides configuration metadata for an OpenID Provider.

Example

https://accounts.google.com/.well-known/openid-configuration

It exposes

• Authorization Endpoint
• Token Endpoint
• UserInfo Endpoint
• JWKS Endpoint
• Supported scopes
• Supported signing algorithms

Spring Security uses this metadata to configure OIDC automatically.

---

Q7. What is Single Sign-On (SSO)?

Single Sign-On allows users to authenticate once and access multiple applications.

SSO Architecture

flowchart LR

User --> IdentityProvider

IdentityProvider --> HRApplication

IdentityProvider --> PayrollApplication

IdentityProvider --> BankingPortal

IdentityProvider --> CRMApplication

Examples

• Google Workspace
• Microsoft Entra ID (Azure AD)
• Okta
• Keycloak

---

Q8. How does OIDC authentication work?

Workflow

1. User clicks Login.

2. Browser redirects to Identity Provider.

3. User authenticates.

4. Authorization Code returned.

5. Code exchanged for:

   • Access Token
   • ID Token

6. Client validates ID Token.

7. User is authenticated.

8. Access Token accesses APIs.

OIDC Login Flow

sequenceDiagram
User->>Client: Login
Client->>OpenIDProvider: Authorization Request
OpenIDProvider->>User: Authenticate
User-->>OpenIDProvider: Credentials
OpenIDProvider-->>Client: Authorization Code
Client->>OpenIDProvider: Exchange Code
OpenIDProvider-->>Client: ID Token + Access Token
Client-->>User: Login Successful

---

Q9. How does Spring Security support OIDC?

Spring Boot enables OIDC with minimal configuration.

Example

http
    .oauth2Login(
        Customizer.withDefaults()
    );

Spring automatically

• Redirects to the provider
• Exchanges the authorization code
• Validates the ID Token
• Loads user information
• Creates the authenticated principal

---

Q10. OIDC Best Practices

Validate ID Tokens

Always verify signature, issuer, audience, and expiration.

---

Always Use HTTPS

Protect authentication traffic.

---

Use Authorization Code + PKCE

Recommended for browser and mobile applications.

---

Minimize Requested Scopes

Request only the information required.

---

Trust Standard Identity Providers

Use providers with strong security practices.

---

Banking Example

flowchart TD

Customer --> BankingPortal

BankingPortal --> GoogleOIDC

GoogleOIDC --> IDToken

IDToken --> BankingPortal

BankingPortal --> BankingDashboard

Customers authenticate once and securely access banking services.

---

Common Interview Questions

• What is OpenID Connect?
• Why do we need OIDC?
• What is an ID Token?
• ID Token vs Access Token?
• What is the UserInfo Endpoint?
• What is the Discovery Endpoint?
• What is Single Sign-On?
• Explain the OIDC authentication flow.
• How does Spring Security support OIDC?
• OIDC best practices?

---

Quick Revision

Topic	Summary
OpenID Connect	Authentication protocol
OAuth2	Authorization framework
ID Token	Authenticated user identity
Access Token	API authorization
UserInfo Endpoint	Additional user profile
Discovery Endpoint	Provider configuration
SSO	Single login across applications
Identity Provider	Authenticates users
PKCE	Secure Authorization Code Flow
HTTPS	Required for secure authentication

---

Complete OpenID Connect Authentication Flow

sequenceDiagram
User->>SpringBootApp: Login
SpringBootApp->>OpenIDProvider: Authorization Request
OpenIDProvider->>User: Login Screen
User-->>OpenIDProvider: Credentials
OpenIDProvider-->>SpringBootApp: Authorization Code
SpringBootApp->>OpenIDProvider: Exchange Code
OpenIDProvider-->>SpringBootApp: ID Token + Access Token
SpringBootApp->>OpenIDProvider: UserInfo Request
OpenIDProvider-->>SpringBootApp: User Profile
SpringBootApp-->>User: Authenticated Session

---

Production Example – Banking Application with Google OpenID Connect

A banking application allows customers to log in using their Google account.

Workflow

1. Customer clicks Continue with Google.

2. Spring Security redirects the browser to Google's OpenID Provider.

3. Customer authenticates successfully.

4. Google returns an Authorization Code.

5. Spring exchanges the code for:

   • ID Token
   • Access Token

6. Spring validates:

   • Signature
   • Issuer
   • Audience
   • Expiration

7. The application optionally retrieves additional profile information from the UserInfo Endpoint.

8. A local banking profile is created or updated.

9. The customer accesses the banking dashboard.

http
    .oauth2Login(Customizer.withDefaults());

flowchart LR

Browser --> SpringSecurity

SpringSecurity --> GoogleOIDCProvider

GoogleOIDCProvider --> AuthorizationCode

AuthorizationCode --> IDToken

IDToken --> IDTokenValidation

IDTokenValidation --> UserInfoEndpoint

UserInfoEndpoint --> CustomerProfile

CustomerProfile --> BankingDashboard

---

OAuth2 vs OpenID Connect

OAuth2	OpenID Connect
Authorization framework	Authentication protocol
Grants API access	Verifies user identity
Access Token	ID Token + Access Token
Does not define user profile	Standard identity claims
No UserInfo Endpoint	Includes UserInfo Endpoint
No Discovery specification	Includes Discovery Endpoint

---

ID Token vs Access Token vs Refresh Token

Token	Purpose	Sent To
ID Token	Authenticate the user	Client Application
Access Token	Access protected APIs	Resource Server
Refresh Token	Obtain new Access Token	Authorization Server

---

Standard OIDC Scopes

Scope	Information Returned
openid	Required for OIDC authentication
profile	Name, picture, locale
email	Email address
phone	Phone number
address	Postal address
offline_access	Refresh token support (provider dependent)

---

Enterprise OIDC Architecture

flowchart TD

User --> Browser

Browser --> SpringBootApplication

SpringBootApplication --> OpenIDProvider

OpenIDProvider --> IDToken

SpringBootApplication --> ResourceServer

ResourceServer --> BankingAPI

ResourceServer --> PaymentAPI

ResourceServer --> LoanAPI

---

Key Takeaways

• OpenID Connect (OIDC) is an authentication protocol built on top of OAuth2 that provides standardized user authentication and identity information.
• OAuth2 handles authorization, while OIDC adds authentication through the ID Token, UserInfo Endpoint, and Discovery Endpoint.
• The ID Token proves the user's identity, whereas the Access Token is used to access protected APIs.
• The Discovery Endpoint enables automatic client configuration by publishing provider metadata such as authorization, token, and UserInfo endpoints.
• Single Sign-On (SSO) allows users to authenticate once and securely access multiple applications using a trusted identity provider.
• Spring Security offers built-in support for OIDC through oauth2Login(), automatically handling redirects, token exchange, ID Token validation, and user authentication.
• Always validate the ID Token's signature, issuer, audience, and expiration before trusting user identity.
• OpenID Connect is the preferred solution for enterprise authentication with providers such as Google, Microsoft Entra ID, Okta, Auth0, and Keycloak.