ID Token (OIDC Only) For AuthN

{
  "alg": "RS256",
  "typ": "JWT"
}

{
  "iss": "https://auth.example.com/",
  "sub": "1234567890",
  "aud": "your-client-id",
  "exp": 1712352000,
  "iat": 1609459200,
  "name": "John Doe",
  "email": "[email protected]"
}

• Header: Indicates that the token is signed with the RS256 algorithm and uses the JWT format.
• Payload:
• iss: Token issuer (authentication server).
• sub: User ID.
• aud: Target of the token (client ID).
• exp: Token expiration time (Unix timestamp).
• iat: Time when the token was issued.
• name: User name.
• email: User email.

Access Token (OAuth 2.0 And OIDC) For AuthZ

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "iss": "https://auth.example.com/",
  "sub": "1234567890",
  "aud": "https://api.example.com/",
  "exp": 1712352000,
  "scope": "read write",
  "client_id": "your-client-id"
}

• Header: Indicates that the token is signed with the HS256 algorithm and uses the JWT format.
• Payload:
• iss: Token issuer (authentication server).
• sub: User or client ID.
• aud: Resource server (API to which the token will be applied).
• exp: Token expiration time.
• scope: Scope of permissions allowed by the token (read/write).
• client_id: Client ID.

Features

OIDC authentication order — expressed as curl (TODO)

1. [Browser Redirect to OIDC Server] Client redirects user browser to authentication server

To authenticate the user, the browser must be redirected to a login page. At this time, the client requests an authorization code from the authentication server.

curl https://auth.example.com/authorize?
  response_type=code&
  client_id=your-client-id&
  redirect_uri=https://yourapp.com/callback&
  scope=openid%20profile%20email&
  state=your-random-state-value

• response_type: code (means Authorization Code Flow)
• client_id: ID of the client application
• redirect_uri: URI to which the user will be redirected after authentication
• scope: openid is required, and additional information such as profile and email may be requested
• state: Random value to prevent CSRF attacks

When the user logs in, the authentication server sends an authorization code to the client’s redirect_uri.

1-1. [OIDC Server to Application Server] Authorization Code Callback

curl https://yourapp.com/callback?code=AUTHORIZATION_CODE&state=your-random-state-value

2. [Application Server to OIDC Server] Request for issuance of ID Token and Access Token with Authorization Code

The authorization code allows the client to request an ID Token and Access Token.

curl -X POST https://auth.example.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTHORIZATION_CODE" \
  -d "redirect_uri=https://yourapp.com/callback" \
  -d "client_id=your-client-id" \
  -d "client_secret=your-client-secret"

• grant_type: authorization_code (token request with code received by client)
• code: authorization code
received earlier
• redirect_uri: The same redirect URI used when requesting the code
• client_id: Client ID
• client_secret: Client’s secret key

2-1. Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "8xLOxBtZp8"
}

• access_token: Access token required for API access.
• id_token: ID Token containing user authentication information.
• refresh_token: A token that can be used to request reissuance when the Access Token has expired.

3. [Client to Application Server] Request a protected resource using an Access Token

You can call protected APIs using the Access Token.

curl -X GET https://api.example.com/userinfo \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

This request provides access to user information or other resources via an Access Token.

*4. [Client to JWT Service] ID Token verification and user information confirmation

The ID Token is used by the client to verify the user’s identity. By decoding this token we can get the user’s information. You can decode this using a JWT decoder or process it directly on the client.

curl -X POST https://jwt.io/ \
  -H "Content-Type: application/json" \
  -d '{"token": "YOUR_ID_TOKEN"}'

This allows you to check user information.

Summary

1. The user authenticates on the login page and obtains an authorization code.
2. Use this code to receive ID Token and Access Token.
3. Access protected resources with Access Token.
4. Verify the user’s authentication information with ID Token.

This sequence is based on the standard authentication flow in OIDC and shows how to make an API request via curl.