Date Published
Author
Jens Langhammer
Word count
968
Language
English
Hacker News points
1

Summary

OpenID Connect (OIDC) is a standard that builds upon OAuth 2.0, adding a standard for user identity verification through tokens issued by an IDP, allowing RPs to verify the identity of users. OIDC was introduced in 2014 and has been widely adopted since then, but its broad adoption also increased diversity and fragmentation. To ensure implementation matches the standard, OIDC has a certification program with Conformance Tests that cover edge cases, uncommon features, and positive/negative flows. Deviations from standards can occur, such as VMware's vCenter requiring an encoded JWT access token not specified in the OpenID standard. However, having a central governing body like the OpenID Connect Foundation ensures standards are enforced, validated, and built upon by independent people, making certification easier to verify compatibility with other software. Standards-compliant applications like authentik aim to adhere to these standards while retaining their feature set.