OpenID Connect is a simple identity layer that allows clients like mobile or web apps to verify user identities based on an authentication performed by an authorization server, as well as obtain basic profile information about users. It is built on OAuth 2.0 and defined by the OpenID Foundation. The specification defines core features as well as optional discovery, dynamic registration, session management, and OAuth 2.0 response types. Major companies like Google, Salesforce, and Microsoft have implemented or are deploying OpenID Connect to provide single sign-on for web and mobile clients.

1. OpenID Connect: An Overview
Pat Patterson
Developer Evangelist Architect
salesforce.com
@metadaddy

2. What is OpenID Connect?
Simple Identity Layer for the Internet
[OpenID Connect] allows Clients to verify the
identity of the End-User based on the
authentication performed by an Authorization
Server, as well as to obtain basic profile
information about the End-User in an
interoperable and REST-like manner.

3. What is OpenID Connect?
• Specification defined by OpenID
Foundation ‘Connect’ Work Group
– NRI, Ping
Identity, Microsoft, Google, Salesforce etc
• Built on OAuth 2.0
• REST-based
• Successor to SAML?

4. OpenID Connect Status
• ‘Nearly complete’
– Second set of OpenID Connect
Implementer’s Drafts approved in July, 2013
– Interop testing under way
– Waiting for dependencies to be
standardized
• JWT, JWS etc

5. OpenID Connect Specification
• OpenID Connect 1.0 Specification
– Core
– Discovery (optional)
– Dynamic Registration (optional)
– Session Management (optional)
– OAuth 2.0 Multiple Response Types
• Implementer’s Guides
– Basic Client Profile
– Implicit Client Profile

6. OpenID Connect Roles
Web-based, mobile, or
JavaScript Clients verify the
identity of End-Users based on
authentication performed by an
Authorization Server.

7. OpenID Connect Basic Client Profile

8. OpenID Connect Implicit Client Profile

9. OpenID Connect Token Response
{
"access_token":"SlAV32hkKG",
"token_type":"Bearer",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"id_token":"eyJ0 ... NiJ9.eyJ1c ... ZXso”
}
• id_token is a JSON Web Token (JWT)
– Signed, URL/filename-safe base64 encoded JSON data

10. OpenID Connect ID Token
{
"iss": "https://server.example.com",
"sub": "24400320",
"aud": "s6BhdRkqt3",
"exp": 1311281970,
"iat": 1311280970
}
• Issuer, Subject, Audience, Expiry, Issued At
• Also optional email, auth_time, nonce etc

11. Who is Deploying OpenID Connect?
• Services:
Google, Salesforce, eBay, AOL, Deutsche
Telekom, Orange
• Vendors: IBM, Microsoft, Ping
Identity, Layer
7, ForgeRock, Gluu, MITRE, NRI

12. OpenID Connect in Action
• Client: Salesforce Community
• Auth Server: Google
• End User: Me!

13. Salesforce Community Login Page

14. Google Login Page

15. Google Authorization Page

16. Salesforce Community Home Page

17. Questions?
Pat Patterson
Developer Evangelist Architect
salesforce.com
@metadaddy