Getting Started: OpenID Connect

Implementing delegated access and federated authentication correctly is critical for modern application security, yet the underlying protocols are often treated as a black box. This course breaks down exactly how OAuth 2 and OpenID Connect work under the hood. You will start by setting up a local development environment using Fiddler and OpenSSL to observe the OAuth Dance in real time. From there, you will explore the role of the OpenID Provider, learn why the Implicit Flow was deprecated for browser and backend applications, and dissect the anatomy of Opaque Tokens and JSON Web Tokens. We will examine the differences between the ID Token and Access Token, and how to request specific user data using Claims, Scopes, and the UserInfo Endpoint.

Once the fundamentals are in place, the course moves into the cryptography that keeps these protocols secure. You will learn how to sign tokens using symmetric and asymmetric algorithms like RSA and Elliptic Curve, and how to properly handle Key Distribution, Key Rotation, and Signature Validation. Next, we cover the modern standard for user authentication: the Authorization Code Flow. You will see how to exchange a code for tokens, manage Refresh Tokens, and secure the flow against attacks using the State Parameter, Nonce, at_hash, and PKCE. Finally, you will implement Single Sign-On, Sign-Out, and Token Revocation, before exploring the Client Credentials Flow for calling APIs and reviewing the latest best current practices in OAuth 2.1.