VersolaVersola/docs
versola.kzGitHub
RUEN

OpenID Connect Core 1.0

Authentication layer on top of OAuth 2.1 — OIDC compliance checklist

Specification: OpenID Connect Core 1.0

OpenID Connect adds an identity layer on top of OAuth 2.0/2.1. It introduces the ID Token, the UserInfo endpoint, and a standard set of user claims.

Flows

  • Authorization Code Flow (response_type=code)
  • Hybrid Flow — partial (response_type=code id_token)
  • Implicit Flow — intentionally not supported (removed in OAuth 2.1)
  • Hybrid Flow — response_type=code token and code token id_token — intentionally not supported (removed in OAuth 2.1)

ID Token

  • JWT-signed ID token returned in token response
  • iss, sub, aud, exp, iat standard claims
  • nonce claim — echoed from authorization request
  • auth_time claim — time of authentication
  • acr claim — Authentication Context Class Reference
  • amr claim — Authentication Method References (RFC 8176)
  • c_hash — code hash in Hybrid Flow
  • at_hash — access token hash — not included in ID token
  • Signed UserInfo response — returned when client sends Accept: application/jwt
  • Encrypted ID token (JWE) — not supported

UserInfo Endpoint

  • GET /userinfo (bearer token required)
  • JSON response
  • sub claim always present
  • Scope-based claim filtering (openid, email, phone, etc.)
  • claims parameter — fine-grained claim selection per request
  • Localized claims (name#fr, name#fr-CA) with fallback
  • Signed JWT UserInfo response — returned when client sends Accept: application/jwt
  • Encrypted UserInfo response — not implemented

Authorization Request Parameters

  • scope=openid — required to trigger OIDC
  • nonce — replay protection for ID tokens
  • max_age — maximum authentication age
  • prompt — none (silent re-auth) and login (force re-auth)
  • acr_values — requested authentication context
  • login_hint — prefill email or phone
  • id_token_hint — hint for silent re-authentication
  • ui_locales — preferred locales for UI and localized claims
  • claims — explicit claim requests for userinfo and id_token
  • request — JWT-encoded request object — not implemented
  • request_uri — URI pointing to a request object — not implemented

Standard Claims (Section 5.1)

  • sub — subject identifier
  • email and email_verified
  • phone_number and phone_number_verified
  • Custom claims per scope (fully configurable)
  • Localized claim variants (claim#locale)
  • address — structured address claim — not a built-in type
  • updated_at — not tracked as a dedicated field

Discovery

  • GET /.well-known/openid-configuration — not yet implemented (see RFC 8414 page)

Session Management & Logout

  • Session Management (OIDC Session Management spec) — not implemented
  • Back-Channel Logout — not implemented
  • Front-Channel Logout — not implemented