OIDC ID Token Literacy
OIDC adds identity; id_token ≠ access_token — use 127.0.0.1:8814.
Visual · oidc_id_token
OpenID Connect id_token vs access token. 127.0.0.1:8814.
OAuth authorizes access. OIDC says who logged in. Mixing the tokens is how APIs get confused.
OpenID Connect layers identity on OAuth. The id_token is a JWT asserting identity claims to the client. The access_token is for the resource server. APIs should not treat a random id_token as an access token unless your design explicitly says so — and Cyberlium labs will show the difference. Dest 127.0.0.1:8814. Never phish for Google id_tokens. Never sqlmap OIDC endpoints on strangers. Next: OAuth Lab — Roles and Token Shape.
1. id_token is for the client’s login story
Validate id_token like a JWT: signature, iss, aud (client id), exp. Then the client knows who authenticated at the AS.
Do not forward id_tokens to every API “because it is JWT.” Access tokens have their own audience.
Command guide
Try these commands — id_token is for the client’s login story
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OpenID Connect Core — https://openid.net/specs/openid-connect-core-1_0.html
Optional command
ID token vs access token — https://auth0.com/docs/secure/tokens/id-tokens
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:8814/.well-known/openid-configuration 2>/dev/null | jq '{issuer,authorization_endpoint,jwks_uri}' || echo 'OIDC discovery on YOUR 127.0.0.1:8814 only'
python3 -c "import base64,json; p='eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjg4MTQifQ'; print(json.loads(base64.urlsafe_b64decode(p+'=='))))"Primary tools to practice this lesson: curl, jq, python3. Reference sites: OpenID Connect Core (https://openid.net/specs/openid-connect-core-1_0.html); ID token vs access token (https://auth0.com/docs/secure/tokens/id-tokens). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. access_token is for the resource server
RS verifies access tokens (JWT or opaque introspection). Scopes/permissions live here for API calls.
On YOUR lab, label which token opens /api/data versus which only proves login to the toy client.
3. Ethics
Fake OIDC providers that harvest passwords are phishing. Refuse kits. Build literacy with loopback toys.
Ship: id_token vs access_token one-liners.
4. What you ship: id_token vs access_token definitions
Two one-liners. Validation checklist for id_token. Dest 127.0.0.1:8814. No phishing kits. DEMO GATE.
5. What you record before the next lesson
Date. Definitions. File t13-m05-l03-oidc-id-token.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Send id_token as Bearer to every API blindly in prod without design. Phish Google users. hydra token endpoints.
- Right: Clear token jobs. Next: OAuth Lab — Roles and Token Shape.
Mission: separate identity token from API token
1) / STOP if router. 2) Write id_token vs access_token jobs. 3) Note which one YOUR 8814 API expects. Never phish id_tokens.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how aud differs for id_token vs access_token — not for a phishing template.
APPLY: id_token primary audience is typically:
APPLY: True or False: access_token is what the resource server consumes for API authorization.
APPLY: A kit that clones the Google account chooser is: