I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) over OAuth2 and so the auth flow is quite standard (visit my app -> redirect to OIDC Provider's (OIDCP) login page -> login/grant access -> return to my app with code -> exchange the code for access/id tokens). However, there are few concepts I'm not completely sure I correctly understood.
I'm using the external provider only for authentication (not authorization), yet I receive 2 tokens (
idtokens). Do I understand correctly that I'd use
accesstoken only to get more info about the user via some user info endpoint that the OIDCP offers and I'd only use it if the information in
id_tokenis not enough?
Would I ever use
id_tokento call some endpoint or is that only some "signed payload" for my app so that my app can get info about the user (i.e. would I ever need to make a request
Authorization: Bearer <id_token>?)
id_tokenmeant to be used only once, i.e. I receive it from the OIDCP's token endpoint, extract the identity (i.e. read
sub), create a session for the user in my application and then forget about the
id_token? Or should I give this token to the user so that whenever he calls an endpoint in my app where I need to know his identity he would pass this token?
If the answer to the previous question is that I should create a session for this user and forget about the
id_tokenthen, semantically speaking, should my session respect the
exptime of the
id_token? In other words, does the
exptime only concern the expiration time of the
id_tokenitself or is it a general "recommendation" for my client app to not set session for this user to be longer than this value?