OpenID Connect

OpenID Connect adds identity to OAuth 2.0: an ID token that says who the user is, plus a discovery document and userinfo endpoint. "Log in with Google" is OpenID Connect.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Explain what OpenID Connect adds to OAuth 2.0
Explain what the ID token says and how it differs from the access token
Use the discovery document to find the endpoints and keys

In practice

A few lines that show OpenID Connect doing its job.

YAML

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope: openid, email, profile
# then: http.oauth2Login(Customizer.withDefaults())
# and @AuthenticationPrincipal OidcUser user in a controller

The common mistake

Watch for

Using the access token as proof of identity. The access token is for calling APIs; the ID token is the signed statement about the user, and it is the one to validate for login.

What to know first

Your roadmap puts these before OpenID Connect, unless you already know them.

OAuth 2.0 flows

How it stays learned

Once a session shows you understand OpenID Connect, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Previous in the module← JWT validation