What it means
OpenID Connect adds an identity assertion on top of OAuth. The identity provider authenticates the subject and issues an ID token, usually alongside an access token. The ID token says the provider completed a sign-in for this client. The application validates the issuer, the audience, the signature, and the time limits, then creates its own session. The access token, not the ID token, is what a resource server should see for an API call.
An ID token does not authorize a shipment export, a role change, or a second application that was not the audience. It also does not prove which person held the device. Federation still needs the relying party to map the subject to local permissions. Single sign-on may follow, but each application keeps its own session and its own authorization rules.
AN ILLUSTRATIVE SCENARIO
FleetLink takes an ID token
Kim signs in through Riverstone’s identity provider. FleetLink validates an ID token whose audience is FleetLink, then opens a session for Kim’s account. The same token presented to TrackPort must fail the audience check. Inside FleetLink, Kim can see assigned routes only. The ID token proved a sign-in to the identity provider. It did not grant trailer 99, and it is not the credential TrackPort’s export API should accept.
Put it to work
- Separate the ID token, which asserts authentication to this client, from the access token, which a resource server may accept for a limited API call.
- Validate issuer, audience, signature, and expiry with a maintained library. Reject a token minted for another application.
- Map the subject to local permissions. Test sign-in, an unassigned action, a wrong-audience token, and what happens to the application session when the account is disabled.
How to check your work
Sign in to a test client and confirm the ID token audience matches that client. Confirm a second client rejects it. Confirm an authenticated session still receives a denial for an unassigned record.
Connect the ideas
- OAuth
A delegated-access framework: a client presents an access token so a resource server can allow a limited action. The token is not proof of who the human is, and it does not grant every action the API could perform.
- Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
- SSO
A pattern where one authentication to an identity provider is reused across multiple applications.
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.