1

I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?

In some sense, the access token does more than just authorisation. It also provides user id (in the sub claim) and after verification, the API (audience of the token) knows both - who you are and what you are allowed to do.

ID token, on the other hand, is meant for the client, but in case of a SPA, I don't really see any point in it at all. A SPA retrieves both tokens, ditches ID token and uses the access token to communicate with an API.

Some questions: - Is it purely because of historical reasons, that we are stuck with two separate tokens? - When do I really need the ID token? What does a SPA do with it?

1

The following link helped me to understand how what could happen if we use OAuth2's access token for authentication, which is called pseudo-authentication:
https://security.stackexchange.com/a/51903/182475

How I understand it, id token in OIDC serves just as a proof to the client application that resource owner authenticated at the Authentication server, and access token is used to tell the requesting Client application which resources the user (Resource owner) has on it (Client) and Authentication server perhaps (user info endpoint). Then client could ask the user (Resource owner) to give it access to other resources, at other Clients, and that access could be provided to the requesting Client in form of another access token or at the same time when the authentication is happening.

I think it would be helpful for you to look at my own recent question, where I provide my own questions regarding how does OIDC work and ask for validation:
Authorization on OAuth2 application that is both Client and Resource Server

And regarding ID token for an SPA, I don't see the point as well. Since SPA is just like the user (Resource Owner) himself, it is like user asked for proof of the authentication which he did himself. I think it is there just to make workflows uniform.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.