What is OpenID Connect (OIDC)?

Short answer

OpenID Connect (OIDC) is the standard that adds an identity layer on top of OAuth 2.0 (OpenID Connect Core 1.0). While OAuth 2.0 gives an application access permission, OIDC also states who the user is with an ID token in JWT format signed by the provider; this way, it can be verified that the identity information really comes from the provider. In TR7 AGS, the OpenID Connect-type Authentication Provider reads the identity from this token: it verifies the signature with the keys at the provider's JWKS URI address and checks the nonce value against replay attacks. Both checks are on by default; Skip Signature Verification is turned on only for testing, and Skip Nonce Validation for providers that do not return the nonce value. Built-in providers such as Google, Microsoft, Apple, Keycloak and Okta are used with this type; Apple is listed only in this type.

Where It Is Used in TR7

Where	Field / label	What for
AGS → Authentication → Authentication Providers	Provider Type = OpenID Connect; OAuth Provider	Obtaining the identity with a signed ID token
Same form	JWKS URI, Skip Signature Verification (off by default), Skip Nonce Validation (off by default)	ID token signature and nonce check
Same form (Custom Provider)	Fetch Endpoints from Issuer → Issuer URL	Filling in the endpoints and the JWKS URI from the discovery document
Same form	Client ID, Client Secret, OAuth Scopes, Redirect URI	The application registration details shared with the OAuth2 type
Same form	Custom User Attribute Mapping; JSONata context Identity Claims (OAuth2 / OIDC)	Mapping the token claims to the AGS user fields

Relation to OAuth 2.0

	OAuth2 type	OpenID Connect type
Purpose	Access permission; the identity is read from the user info response	Identity and access permission
Where the identity comes from	User info endpoint	The ID token whose signature is verified; combined with the user info response
Additional check	-	Signature with JWKS, nonce
Form	Shared	Shared, plus the JWKS URI and the two Skip options

Common Misconceptions

• "OIDC is a separate protocol that replaces OAuth." OIDC is built on top of OAuth 2.0; the flow is the same, and the ID token is added with the openid scope.
• "Turning off signature verification causes no problems." If Skip Signature Verification is turned on, it is not verified that the identity really comes from the provider; this option is only for testing.
• "If the JWKS URI is empty in a built-in provider, the signature is not verified." In built-in providers, the key address comes from TR7's catalog; in Custom Provider, if the field is left empty, the address is derived from the issuer, so filling in the field with Fetch Endpoints from Issuer is recommended.

How it is done in the documentation

• OpenID Connect · What Is OpenID Connect?
• OpenID Connect · JWKS URI
• OpenID Connect · Fetch Endpoints from Issuer

Related questions

• What is OAuth 2.0?
• What is the difference between an access token and an ID token?
• What is a JWT (JSON Web Token); where is it used in TR7?
• What is an issuer; what is the OIDC discovery document (.well-known/openid-configuration) for?