Documentation / Platform glossary / OpenId Connect
OpenID Connect is an identity layer built on top of OAuth 2.0. Where OAuth answers what an application is permitted to do, OpenID Connect answers who the user is, by issuing a signed ID token alongside the access token. It is the modern standard for federated sign-in.
OIDC adds a small number of well-specified pieces to OAuth. The ID token is a JSON Web Token containing claims about the authenticated user — a stable subject identifier, who issued it, which application it was intended for, when authentication occurred, and when the token expires. The application validates the signature and those claims before trusting it.
The userinfo endpoint returns additional profile claims when the application needs more than the ID token carries. Scopes such as openid, profile, and email declare which claims are requested. Discovery lets a relying party fetch an provider's endpoints and signing keys from a well-known configuration document, so integration does not require manual metadata exchange.
The distinction from OAuth is worth stating precisely, because conflating them is a real source of vulnerabilities. An OAuth access token is meant for the resource server and says nothing verifiable about the user's identity to the client. An OIDC ID token is meant for the client and is specifically an authentication statement, with an audience claim that must be checked.
OIDC gives federated sign-in the same directory-authoritative property as SAML while working naturally for mobile and single-page applications, and it does so with JSON and HTTP rather than XML. New integrations generally start here.
Validation is where implementations go wrong. An ID token whose signature, issuer, audience, and expiry are not all checked is not an authentication statement — it is unverified input.
QueryTek supports OIDC-based federated sign-on so authentication stays with the customer's identity provider and resolves to the correct tenant context. Public documentation describes the capability; provider configuration is handled during onboarding.
