F.2 Why OpenID Connect

OAuth allows users to authorize client applications to access users' protected resources through an Access token. The Access token does not contain any information about a user's identity. Hence, a client application does not know who the user is. A client application also does not know if the authorization server has issued the access token to it or to any other relying party.

OpenID Connect builds on OAuth and provides solutions for OAuth’s limitations. It issues an ID token that contains signed assertions about the user. Client applications can verify the ID token and obtain additional details about the user. The ID token also contains information about the issuing authority, the intended client application, time of the token created, and the token expiration time.

OpenID Connect Claims: A client application obtains information about a user and authentication events through claims. A claim contains information about a user such as phone number, first name, and last name.