Skip to main content
OpenID Connect (OIDC) is an identity and authentication layer that extends the OAuth 2.0 protocol. OAuth 2.0 involves the use of access tokens to enable access to or perform actions against resources across separate systems; while OIDC enables a client to access details about the users, and standardizes how an Identity Provider (IdP) brokers authentication across multiple services. OIDC introduces the following concepts to the OAuth framework:
  • ID Token - New token type a client can request and then exchange for information about the users.
  • UserInfo Endpoint - API implemented by the authZ server. Allows a client to request user data.
  • Claims - Name/value pairs of user data that the client requests. For example, an users’s first name.
  • Standard Scopes - Known scope identifiers that map to the pieces of user data a client can request.
Additionally, although the actors remain the same, OIDC renames a few OAuth terms to expand their role:
  • The Resource Owner is now called the Subject. This is the users who owns their data in the IdP’s server.
  • The Authorization Server (which, in the identify domain, is an authentication server) is called the Issuer.
  • The client is called the Relying Party (RP). It relies on the issuer to identify the users and issue tokens. Note: When you register a client with Storefront Gateway, it is registered as a Relying Party (RP). When the RP makes requests to Storefront Gateway, it needs to leverage our OIDC-specific API. The API will respond to your client based on the Authorization Grant Type and other settings that are configured for that Relying Party.