OpenID Connect (OIDC)

OAuth 2.0 only answers whether an application may access something. OIDC adds who the user is: the identity provider issues an ID token in JWT format with claims such as sub, email and name. For SSO in new applications, OIDC is now usually preferred over SAML.

Setup is manageable: register client ID, client secret and redirect URI at the IdP, then enter the issuer URL in the application. It fetches every other endpoint from the discovery document at /.well-known/openid-configuration.

Common mistakes: the redirect URI does not match character for character (redirect_uri_mismatch), the wrong claim is used as username, or expired client secrets in Microsoft Entra ID silently break login.

Example