Backend interview prep

Start

OpenID Connect (OIDC) Basics Interview Questions and Answers

Learn OpenID Connect (OIDC) fundamentals with interview questions, Mermaid diagrams, Spring Security examples, and enterprise authentication best practices.

OpenID Connect (OIDC) Basics - Interview Questions & Answers

OpenID Connect (OIDC) is an identity layer built on top of OAuth2.

While OAuth2 answers:

"Can this application access the resource?"

OIDC answers:

"Who is the user?"

OIDC is the standard authentication protocol used by Google, Microsoft Entra ID, Keycloak, Okta, Auth0, GitHub, Amazon Cognito, and most enterprise Identity Providers.

It is one of the most frequently asked topics in Spring Security, Microservices, Cloud, and Solution Architect interviews.

Q1. What is OpenID Connect (OIDC)?

Answer

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth2.

It allows applications to verify a user's identity and obtain basic profile information in a secure and standardized way.

OIDC Authentication Flow

flowchart LR

User --> Client

Client --> IdentityProvider

IdentityProvider --> IDToken

IdentityProvider --> AccessToken

IDToken --> Client

Client --> ResourceServer

Benefits

  • User Authentication
  • Single Sign-On (SSO)
  • Standard Identity Protocol
  • Secure User Login

Q2. Why do we need OIDC?

Answer

OAuth2 provides authorization but does not define how applications authenticate users.

OIDC fills this gap by introducing:

  • ID Token
  • UserInfo Endpoint
  • Standard User Claims
  • Authentication Standard

OAuth2 vs OIDC

flowchart TD

OAuth2 --> Authorization

OIDC --> Authentication

Authentication --> UserIdentity["User Identity"]

Interview Tip

OAuth2 = Authorization

OIDC = Authentication + OAuth2

Q3. What is the difference between OAuth2 and OIDC?

Answer

OAuth2 OpenID Connect
Authorization Framework Authentication Protocol
Issues Access Token Issues Access Token + ID Token
API Authorization User Authentication
Resource Access User Identity

Comparison

flowchart LR

OAuth2 --> AccessTokenProtectedApi["Access Token → Protected API"]

OIDC --> IdTokenUserIdentity["ID Token → User Identity"]

Q4. What is an ID Token?

Answer

An ID Token is a JWT issued by the Identity Provider that contains information about the authenticated user.

Typical claims include:

  • sub (User ID)
  • name
  • email
  • picture
  • iss
  • aud
  • exp

ID Token Structure

flowchart TD

IdToken["ID Token"] --> Header

IdToken["ID Token"] --> Payload

IdToken["ID Token"] --> Signature

Payload --> UserClaims["User Claims"]

Example Claims

  • User ID
  • Name
  • Email
  • Login Time

Q5. What are the main OIDC components?

Answer

OIDC consists of four main participants.

Component Responsibility
End User Authenticates
Client Application Requests login
Identity Provider (IdP) Authenticates users and issues tokens
Resource Server Hosts protected APIs

OIDC Components

flowchart LR

User --> Client

Client --> IdentityProvider

IdentityProvider --> IDToken

IdentityProvider --> AccessToken

AccessToken --> ResourceServer

Q6. What is the UserInfo Endpoint?

Answer

The UserInfo Endpoint is an OIDC endpoint that returns additional user profile information.

It is accessed using the Access Token.

Example information:

  • Name
  • Email
  • Phone
  • Address
  • Profile Picture

UserInfo Flow

flowchart LR

AccessToken["Access Token"] --> UserinfoEndpoint["UserInfo Endpoint"]

UserinfoEndpoint["UserInfo Endpoint"] --> UserProfile["User Profile"]

Benefits

  • Standardized profile retrieval
  • Avoids custom APIs
  • Works across providers

Q7. How does OIDC authentication work?

Answer

The authentication process consists of:

  1. User clicks Login.
  2. Client redirects to Identity Provider.
  3. User authenticates.
  4. Identity Provider issues:
    • ID Token
    • Access Token
  5. Client validates the ID Token.
  6. Client optionally calls the UserInfo Endpoint.

Complete Flow

sequenceDiagram
participant User
participant Client
participant IdentityProvider
participant ResourceServer
User->>Client: Login
Client->>IdentityProvider: Authentication Request
IdentityProvider-->>User: Login Screen
User->>IdentityProvider: Credentials
IdentityProvider-->>Client: ID Token + Access Token
Client->>ResourceServer: Access Token
ResourceServer-->>Client: Protected Resource

Q8. What are common OIDC implementation mistakes?

Answer

Common mistakes include:

  • Not validating the ID Token
  • Ignoring token expiration
  • Missing issuer validation
  • Missing audience validation
  • Using HTTP instead of HTTPS
  • Hardcoded client secrets
  • Trusting unsigned tokens

Wrong Design

Receive ID Token

↓

Use Directly ❌

Correct Design

Receive ID Token

↓

Validate Signature

↓

Validate Claims

↓

Authenticate User ✅

Q9. How is OIDC implemented in Spring Security?

Answer

Spring Security provides built-in support for OpenID Connect.

Typical architecture:

flowchart TD

User --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> KeycloakOktaAuth0["Keycloak / Okta / Auth0"]

KeycloakOktaAuth0["Keycloak / Okta / Auth0"] --> IdToken["ID Token"]

KeycloakOktaAuth0["Keycloak / Okta / Auth0"] --> AccessToken["Access Token"]

SpringBootClient["Spring Boot Client"] --> SpringBootApis["Spring Boot APIs"]
  • Keycloak
  • Okta
  • Auth0
  • Microsoft Entra ID
  • Google Identity
  • Amazon Cognito

Q10. What are the enterprise best practices for OIDC?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Validate every ID Token.
  • Validate issuer (iss).
  • Validate audience (aud).
  • Validate expiration (exp).
  • Use Authorization Code Flow.
  • Use PKCE for public clients.
  • Keep Access Tokens short-lived.
  • Protect Refresh Tokens.
  • Monitor authentication events.

Enterprise OIDC Architecture

flowchart TD

User --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> SpringBootClient["Spring Boot Client"]

SpringBootClient["Spring Boot Client"] --> IdToken["ID Token"]

SpringBootClient["Spring Boot Client"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootMicroservices["Spring Boot Microservices"]

OIDC Overview

mindmap
  root((OpenID Connect))
    Authentication
    ID Token
    Access Token
    UserInfo Endpoint
    Identity Provider
    JWT
    Spring Security
    OAuth2

Senior Interview Tip

Modern enterprise authentication typically combines:

  • OpenID Connect → User Authentication
  • OAuth2 → Authorization
  • JWT → Token Format
  • Spring Security → Security Enforcement
  • API Gateway → API Protection
  • mTLS → Service Authentication
  • MFA → Strong User Authentication
  • Zero Trust → Continuous Verification

Remember:

  • OAuth2 answers: Can this application access the resource?
  • OIDC answers: Who is the authenticated user?

Quick Revision

  • OpenID Connect is built on top of OAuth2.
  • OIDC provides authentication, while OAuth2 provides authorization.
  • OIDC introduces the ID Token.
  • ID Tokens are typically JWTs.
  • The UserInfo Endpoint returns additional user profile information.
  • Always validate ID Tokens.
  • Use Authorization Code Flow with PKCE when appropriate.
  • Protect all communication using HTTPS.
  • Spring Security provides first-class support for OIDC.
  • OIDC is the industry standard for Single Sign-On (SSO) and enterprise authentication.