Overview
ISO/IEC 26131:2024 - OpenID Connect Core 1.0 (incorporating errata set 2) specifies a simple identity layer built on top of the OAuth 2.0 framework. It defines how Clients (Relying Parties) can verify End-User identity using an Authorization Server (OpenID Provider) and obtain interoperable profile information in a REST-like manner. The standard describes the use of ID Tokens (JWTs), Claims, registration and discovery mechanisms, and the security and privacy considerations required for robust OpenID Connect (OIDC) implementations.
Key topics and technical requirements
- Authentication on OAuth 2.0: Defines how authentication is implemented as an extension of OAuth 2.0 (use of the openid scope and ID Token delivery).
- ID Token and JWT: Specifies ID Token format, validation rules and interaction with JSON Web Token (JWT) constructs.
- Flows: Details core authorization flows - Authorization Code, Implicit, and Hybrid - including endpoint behavior, request/response formats, and validation.
- Claims and UserInfo: Standard claims, claim languages/scripts, UserInfo endpoint behavior, and how Clients request and consume claims.
- Client registration & discovery: Assumes prior discovery (OpenID Connect Discovery) and supports dynamic client registration patterns.
- Security requirements: Extensive guidance on token handling, signature/encryption (JWS/JWE), TLS, token lifetimes, replay and substitution threats, and recommended mitigations.
- Privacy considerations: Guidance on PII handling, correlation risks, offline access, and data access monitoring.
- Operational details: Client authentication methods, key rotation, refresh token use, serializations (JSON/Form/Query), and implementation notes for compatibility and interoperability.
- Self-Issued Provider & Subject Identifiers: Support for self-issued providers and subject identifier algorithms (including pairwise identifiers).
Practical applications & who uses it
- Identity Providers (IdPs) / OpenID Providers implementing interoperable authentication and token services.
- Application developers and architects building web, mobile, or API-based systems that require single sign-on (SSO), federated identity, or secure user profile retrieval.
- Security engineers designing token validation, encryption/signature policies and secure OAuth/OIDC deployments.
- Enterprise SSO & consumer “social login” integrations, federations and API authorization systems that need standardized identity assertions.
Benefits include standardized ID Tokens, interoperable claims exchange, improved security posture, and consistent client-server behavior across providers.
Related standards
- OAuth 2.0 Authorization Framework (RFC 6749)
- OAuth 2.0 Bearer Token Usage (RFC 6750)
- JSON Web Token (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE)
- OpenID Connect Discovery 1.0
- OpenID Connect Dynamic Client Registration 1.0
- RFC 2119 (requirements language)
Keywords: OpenID Connect, ISO/IEC 26131, OAuth 2.0, ID Token, JWT, claims, authentication, Relying Party, OpenID Provider, discovery, dynamic registration, SSO, security, privacy.