OAuth / OIDC - How to inform a resource server about a user's identity

user_9298910 0
Viewed 260

I want to implement OAuth / OIDC into my system. I would have a central OpenID Provider and multiple Resource Servers. Each of these resource servers need to know which user they are talking to. For this, they require the user's ID.

My first instinct was to pass the ID token to the resource server, but everywhere I looked, I read that this is a bad Idea and generally not how things are done.

The next idea was to store that data in the Access Token. The OAuth standard says, that that token is opaque to the client (but not necessarily to the resource server). Does that mean, that storing a user ID in the access token is the way to go or is there a better alternative?

oauth-2.0 openid-connect
1 Answers

Yes. It is okay to store the user ID in the access token and you just decode it to get its value. For JWT access token , it also does the same by storing the user ID in the field with the claim name sub.

For the opaque token , there is a specification defines how to get the user 's info for the resource server . It basically makes a request to the authorization server to validate the access token as well as returning the user 's info. It also mentions to use the field name sub to refer to the user ID which is defined as :

Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.

user_3396370
Related