I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) over OAuth2 and so the auth flow is quite standard (visit my app -> redirect to OIDC Provider's (OIDCP) login page -> login/grant access -> return to my app with code -> exchange the code for access/id tokens). However, there are few concepts I'm not completely sure I correctly understood.
I'm using the external provider only for authentication (not authorization), yet I receive 2 tokens (
access
andid
tokens). Do I understand correctly that I'd useaccess
token only to get more info about the user via some user info endpoint that the OIDCP offers and I'd only use it if the information inid_token
is not enough?Would I ever use
id_token
to call some endpoint or is that only some "signed payload" for my app so that my app can get info about the user (i.e. would I ever need to make a requestAuthorization: Bearer <id_token>
?)Is the
id_token
meant to be used only once, i.e. I receive it from the OIDCP's token endpoint, extract the identity (i.e. readsub
), create a session for the user in my application and then forget about theid_token
? Or should I give this token to the user so that whenever he calls an endpoint in my app where I need to know his identity he would pass this token?If the answer to the previous question is that I should create a session for this user and forget about the
id_token
then, semantically speaking, should my session respect theexp
time of theid_token
? In other words, does theexp
time only concern the expiration time of theid_token
itself or is it a general "recommendation" for my client app to not set session for this user to be longer than this value?
Thanks