OpenID Connect and Identity

Once ReadShelf can import a customer's bookstore reading lists, adding “Sign in with Bookstore” may seem like a small next step. But receiving an access token for reading lists leaves several identity questions unanswered: which bookstore account authenticated, whether the provider intended the response for ReadShelf, and which local account should receive the session.

OpenID Connect adds a standardized identity layer to OAuth 2.0. It lets an application validate information about an authenticated user and the authentication event.

This chapter explains ID tokens, identity validation, profile retrieval, account mapping, and the boundary between an external login and an application's own session.

The example uses a ReadShelf web application with a confidential backend. The bookstore acts as its identity provider at https://auth.bookstore.example. ReadShelf uses authorization code flow with PKCE over HTTPS, keeps tokens on the backend, and establishes its own browser session after successful validation. Endpoint paths and local account rules are illustrative application choices.