OpenID Connect is an authentication protocol and identity layer on top of OAuth 2.0 used in many SSO and adopted in many social logins (Apple, Facebook, Google, etc). Basically, it allows a user to authenticate to a service using an existing account from an OpenID Connect Provider (OP), sharing some identity information after the user consent, and get an access token to access resources on a Relying Party (RP) application.
Find this curated list of providers, services, libraries, and resources to adopt it and know more about existing and draft specs.
Open Source authentication, authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing single sign-on (SSO).
Provider that acts as a portal to other identity providers through "connectors." like LDAP, SAML, OIDC or established identity providers like GitHub, Google, and Active Directory.
Open Source OpenID Connect/OAuth 2.0 provider aims to be a bridge between applications and identity providers to authenticate, authorize and getting information about user accounts.
An Open-source solution designed for Customer Identity and Access Management (CIAM) and Workforce Identity Management with OpenID Connect based authentication.
Extensible solution that enables both customer and workforce identity with federation, single sign-on, API security and workflows for both cloud and on-prem solutions.
Identity Server which provides modern identity and access management capabilities that can be easily built into organization's customer experience (CX) applications.
Test conformance suite to obtains OpenID Foundation certification which covers OpenID Connect, FAPI1-Advanced, FAPI2, FAPI-CIBA and OpenID for Identity Assurance (ekyc).
OpenID Connect Providers as SaaS and Open Source solutions.
Relying Parties (RP) Libraries
Relying Parties (RP) Libraries for implementing OpenID Connect on a client application.
Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 used to authorize a client to get an access token with a SAML assertion issued by a trusted provider.
Defines the core OpenID Connect functionality: authentication built on top of OAuth 2.0 and the use of Claims to communicate information about the End-User. It also describes the security and privacy considerations for using OpenID Connect.
Pushed authorization request (PAR) allows clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request.
Allows to send request parameters in a JSON Web Token (JWT), which can be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained.
Logout mechanism that uses front-channel communication via the User Agent between the OpenID Connect provider (OP) and Relying Parties (RPs) being logged out that does not need an OpenID Provider iframe on Relying Party pages.
Defines how a Relying Party can requests that the OpenID Connect provider log out the End-User by redirecting the End-User's User Agent to the OP's Logout Endpoint.
Endpoint for OAuth authorization servers which allows clients to notify the authorization server that a previously obtained refresh or access token is no longer needed.
Mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level which allows for the detection of replay attacks with tokens.
Method for a protected resource to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token.
Extends OAuth 2.0 authorization requests with additional authorization_details parameter that allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures.
Specifications about a mechanism by which a Relying Party can request that particular authentication policies like multi-factor authentication be applied by the OpenID Provider.
Metadata format that an OAuth 2.0 client or authorization server can use to obtain the information needed to interact with an OAuth 2.0 protected resource.
Specifications for OpenID Connect Extended Authentication Profile (EAP) ACR Values which allows to request specific authentication methods and assurance levels.
Defines a new iss parameter in the authorization response in order to identify the authorization server that issued the authorization response and mitigates mix-up attacks.
Shared Signals Framework (SSF) enables sharing of signals and events between cooperating peers that enables multiple applications such as Risk Incident Sharing and Coordination (RISC) and the Continuous Access Evaluation Profile (CAEP).
Enables AI agents and apps to securely access and act across multiple services with user consent using standardized and fine-grained OAuth permissions.
Preserves user identity, authorization context, and call-chain history across multiple services and trust domains using OAuth token exchange and JWT-based assertions.
A research proposal (not a standard or IETF draft) extending OpenID Connect to support AI agent identity, attestation, delegation chains, and fine-grained authorization within the OAuth ecosystem.
How the Model Context Protocol uses OAuth 2.1 with mandatory PKCE, RFC 8707 audience binding, and zero-configuration discovery for AI agent authentication.
