What is the difference between ID token and access token, and how to implment them using JWT?

user_15092227 0
Viewed 99

So i have been reading about the difference between ID token and access token is for authorization. I don't know how to implement the ID token, which should be a JWT.

The access token i have been implementing looks like this:

const accountCredentials = {
    username: account.username,
    accountId: account.accountId,
    grant_type: "password"
}

const token = jwt.sign(accountCredentials, config.JWT_KEY, { expiresIn: "1h" })

so i wonder, what is an ID token supposed to contain and how to implement it as described by the openID connect specification. I'm sorry, this might sound stupid but i really don't understand the documentation.

jwt node.js openid-connect javascript
1 Answers

An ID token is a token which allows your app to identify the user. It is always a JWT, and it's contents are described in this section of the OIDC docs: https://openid.net/specs/openid-connect-core-1_0.html#IDToken So to have a valid ID token, you need a JWT which contains at least these claims: iss, sub, aud, exp, iat. You can check in the spec, what each of these claims should contain. Additionally, the ID token must be at least signed (it can also be encrypted).

In your code you will have something like that:

const accountCredentials = {
    iss: '...',
    sub: account.username,
    aud: '...',
    iat: now()
}

const token = jwt.sign(accountCredentials, config.JWT_KEY, { expiresIn: "1h" })

Note that OpenID Connect spec only specifies authorization code, implicit and hybrid flows. Using password grant type is not part of the OIDC standard.

user_17122940
Related