OIDC/OAuth2 id_token and it's usage in the client application

Question

I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) over OAuth2 and so the auth flow is quite standard (visit my app -> redirect to OIDC Provider's (OIDCP) login page -> login/grant access -> return to my app with code -> exchange the code for access/id tokens). However, there are few concepts I'm not completely sure I correctly understood.

1. I'm using the external provider only for authentication (not authorization), yet I receive 2 tokens (access and id tokens). Do I understand correctly that I'd use access token only to get more info about the user via some user info endpoint that the OIDCP offers and I'd only use it if the information in id_token is not enough?

2. Would I ever use id_token to call some endpoint or is that only some "signed payload" for my app so that my app can get info about the user (i.e. would I ever need to make a request Authorization: Bearer <id_token>?)

3. Is the id_token meant to be used only once, i.e. I receive it from the OIDCP's token endpoint, extract the identity (i.e. read sub), create a session for the user in my application and then forget about the id_token? Or should I give this token to the user so that whenever he calls an endpoint in my app where I need to know his identity he would pass this token?

4. If the answer to the previous question is that I should create a session for this user and forget about the id_token then, semantically speaking, should my session respect the exp time of the id_token? In other words, does the exp time only concern the expiration time of the id_token itself or is it a general "recommendation" for my client app to not set session for this user to be longer than this value?

Thanks

Answer 1

1. Access token is used to grant access to resources for which your external provider is in role of Authorization Server. In this case the UserInfo endpoint is the resource which access is secured by your external provider.

2. No. You will never do the request with identity token as a Bearer token. But there are requests defined in OpenIDConnect protocole where you can use an id_token as a "hint". The example is authentication request where you sent id_token_hint to point which authenticated (or past authenticated) session was already issued (valid or invalid).

3. The id_token is issued only for client which requested it (it is called Relying Party). You should not send this token to any other parties (clients or resources). From my experience I have short lived identity tokens (5 minutes). I validate this and confirm the user is correct (extract "sub" and validate the token). If I want to get the user credentials I can also extract those from id_token (only if the identity provider have included those in it) but more often I use UserInfo endpoint to request those with access token. After that I create the application session with all user information. Important is that I store the id_token in some storage (i.e. application session) for usage like I explained earlier.

4. No. You do not have respect "Exp" of the id_token. Look at my answer on 3. My id token is valid for 5 minutes but session is much longer. I would said that this is "just" a recommendation.

Hope it will help you.