OpenID Connect (OIDC) — Complete Authentication Guide

import jwt
import requests
from jwt import PyJWKClient

class OIDCClient:
    def __init__(self, client_id, client_secret, issuer, redirect_uri):
        self.client_id = client_id
        self.client_secret = client_secret
        self.issuer = issuer
        self.redirect_uri = redirect_uri
        self.config = self._discover_config()

    def _discover_config(self):
        well_known = f"{self.issuer}/.well-known/openid-configuration"
        response = requests.get(well_known, timeout=10)
        response.raise_for_status()
        config = response.json()
        print(f"[OIDC] Discovery: {config.get('issuer')}")
        print(f"[OIDC] Auth endpoint: {config.get('authorization_endpoint')}")
        print(f"[OIDC] JWKS URI: {config.get('jwks_uri')}")
        return config

    def verify_id_token(self, id_token):
        jwks_client = PyJWKClient(self.config["jwks_uri"])
        signing_key = jwks_client.get_signing_key_from_jwt(id_token)

        claims = jwt.decode(
            id_token,
            signing_key.key,
            algorithms=["RS256"],
            audience=self.client_id,
            issuer=self.issuer,
            options={
                "verify_exp": True,
                "verify_iat": True,
                "require": ["sub", "iss", "aud", "exp", "iat"],
            },
        )
        print(f"[OIDC] ID Token verified for user: {claims.get('sub')}")
        print(f"[OIDC] Email: {claims.get('email', 'N/A')}")
        print(f"[OIDC] Name: {claims.get('name', 'N/A')}")
        return claims

    def get_userinfo(self, access_token):
        response = requests.get(
            self.config["userinfo_endpoint"],
            headers={"Authorization": f"Bearer {access_token}"},
            timeout=10,
        )
        response.raise_for_status()
        return response.json()

# Usage
client = OIDCClient(
    client_id="myapp",
    client_secret="secret",
    issuer="https://accounts.example.com",
    redirect_uri="https://myapp.com/callback",
)

# After receiving id_token from authorization flow:
# claims = client.verify_id_token(id_token)

const { Issuer, generators } = require("openid-client");

async function setupOIDC() {
  const issuer = await Issuer.discover("https://accounts.example.com");
  console.log(`Discovered issuer: ${issuer.issuer}`);

  const client = new issuer.Client({
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET,
    redirect_uris: ["https://myapp.com/callback"],
    response_types: ["code"],
  });

  const code_verifier = generators.codeVerifier();
  const state = generators.state();

  const authUrl = client.authorizationUrl({
    scope: "openid profile email",
    code_challenge: generators.codeChallenge(code_verifier),
    state,
  });

  console.log(`Authorization URL: ${authUrl}`);

  async function handleCallback(callbackParams) {
    const tokenSet = await client.callback(
      "https://myapp.com/callback",
      callbackParams,
      { code_verifier, state }
    );

    console.log(`ID Token: ${tokenSet.id_token}`);
    console.log(`Access Token: ${tokenSet.access_token.substring(0, 20)}...`);

    const userinfo = await client.userinfo(tokenSet.access_token);
    console.log(`User: ${userinfo.name} (${userinfo.email})`);

    return userinfo;
  }

  return { authUrl, handleCallback };
}

import jwt
import requests
import sys
from jwt import PyJWKClient

def validate_oidc_token(id_token, issuer, client_id):
    try:
        config_url = f"{issuer}/.well-known/openid-configuration"
        config = requests.get(config_url, timeout=10).json()
        jwks_uri = config["jwks_uri"]
        jwks_client = PyJWKClient(jwks_uri)
        signing_key = jwks_client.get_signing_key_from_jwt(id_token)

        claims = jwt.decode(
            id_token, signing_key.key, algorithms=["RS256"],
            audience=client_id, issuer=issuer,
            options={"verify_exp": True, "require": ["sub", "iss", "aud", "exp"]},
        )
        print("=== ID Token Validation PASSED ===")
        print(f"Subject: {claims.get('sub')}")
        print(f"Issuer: {claims.get('iss')}")
        print(f"Email: {claims.get('email', 'N/A')}")
        print(f"Name: {claims.get('name', 'N/A')}")
        print(f"Expires: {'OK' if claims.get('exp', 0) > __import__('time').time() else 'EXPIRED'}")
    except Exception as e:
        print(f"Validation FAILED: {e}")

if __name__ == "__main__":
    token = sys.argv[1]
    validate_oidc_token(token, "https://accounts.example.com", "myapp")