Using OpenId Connect for securing API

Question

I have several REST APIs which I want to secure with a federated authorization server. This page: https://oauth.net/articles/authentication/ suggests that OAuth2 alone is not enough for authentication and one should use the OpenId Connect extension to get it right.

However, I have the feeling that what OIDC does is only defining an identity endpoint and the related scopes and claims. If I don't specifically need these identity claims, what's wrong with using plain OAuth authorization code for authenticating a user and protecting resource? Or is OAuth2 only for delegating access to a client app which works on behalf of the user (which is not my use cas)?

Thanks for the inputs!

Answer 1

Most end user authentication related work occurs on the UI side of things, and of course involves Authorization Redirects, Identity Providers, Consent Forms and so on.

In terms of the code for a Secured REST API you instead perform the following types of action. This is primarily OAuth 2.0 behaviour as you say, though Open Id Connect endpoints can be useful:

• Validate received access tokens from the Authorization Server
• Read token claims to identify the authenticated user
• To do this you may need to download token signing keys from the JWKS endpoint
• Your API can look up further details from the User Info endpoint
• Your API can use the metadata endpoint to get the above endpoint locations
• Your API will then apply authorization rules based on claims and scopes