{"id":4755,"date":"2024-03-02T20:51:55","date_gmt":"2024-03-02T19:51:55","guid":{"rendered":"https:\/\/rock-the-prototype.com\/unkategorisiert\/openid-connect-a-key-to-digital-identities\/"},"modified":"2024-03-03T09:05:49","modified_gmt":"2024-03-03T08:05:49","slug":"openid-connect-a-key-to-digital-identities","status":"publish","type":"post","link":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/","title":{"rendered":"OpenID Connect &#8211; A key to digital identities"},"content":{"rendered":"<p><\/p><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1\"><p class=\"p1\">With <strong>Open ID Connect<\/strong>, today we are delving deeper into the world of <a href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/authentication\/\" target=\"_blank\" title=\"Authentication is a multi-step process in identity management. Authentication in an IT system implements IT security functions that are realized by various security services and components.\" class=\"encyclopedia\">authentication<\/a> and identity verification and shedding light on the standard protocol <a href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/openid\/\" target=\"_blank\" title=\"All about OpenID - Discover everything you need to know about OpenID: from secure authentication and identity federation to the latest developments like OpenID Connect and the OpenID Foundation. Here you will find a comprehensive overview of digital identity.\" class=\"encyclopedia\">OpenID<\/a> Connect &ndash; or <strong>OIDC<\/strong> for short.<\/p>\n<p class=\"p1\">This protocol is at the heart of modern digital identity systems and enables us to access a wide range of digital services securely and efficiently.<\/p>\n<p class=\"p1\">But what makes OpenID so special and why is it indispensable for digital identity management?<\/p>\n<p class=\"p1\">In the next few minutes you will find out how OIDC is based on the OAuth <a href=\"https:\/\/rock-the-prototype.com\/en\/programming-languages-frameworks\/framework\/\" target=\"_blank\" title=\"A framework is a set of guidelines or rules that provides a structure for the organization and development of code in a particular programming language or platform. The framework serves as a basis or blueprint on which to build when developing software applications.\" class=\"encyclopedia\">framework<\/a>, what advantages it offers and how the OpenID Federation helps to ensure the security and interoperability of our digital identities. We will also look at the challenges and criticisms associated with the implementation of OIDC.<\/p>\n<p class=\"p1\">So let&rsquo;s jump straight into the Ident topic and reveal how OpenID Connect is changing the way we can authenticate ourselves both securely and conveniently online.<\/p>\n\n<\/div><div class=\"fusion-text fusion-text-2\"><h2 class=\"p1\">OIDC &ndash; The heart of digital authentication and identity verification<\/h2>\n<p class=\"p1\">You&rsquo;re probably familiar with this: one click and you&rsquo;re logged in to a completely different platform via Google, Facebook or other services.<\/p>\n<p class=\"p1\">But wait!<\/p>\n<p class=\"p1\">Before we get to that magic click, a crucial step takes place in the background. Exactly, the classic credentials &ndash; user name and password &ndash; are requested once from the service, such as Google or Facebook. Only then does OpenID Connect enable us to make this smooth transition without having to authenticate ourselves each time using a user name and password.<\/p>\n<p class=\"p1\">The answer to this is a powerful protocol called OpenID Connect.<\/p>\n<p class=\"p1\">But to really understand OIDC, we need to take a step back and briefly look at OAuth 2.0.<\/p>\n<p class=\"p1\">OAuth 2.0 is a framework. As such, OAuth is also an open standard for access authorizations that enables Internet users to share their resources on a website without disclosing their access data to a second website. However, a framework differs fundamentally from a protocol in many respects.<\/p>\n<p class=\"p1\">It is therefore important to clarify these two basic terms in advance.<\/p>\n<\/div><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.Spotify - Podcast Folge 15 - OpenID Connect - Ein Schl&uuml;ssel zu digitalen Identit&auml;ten - Rock the Prototype - Softwareentwicklung &amp; Prototyping\" href=\"#\"><iframe class=\"lazyload\" style=\"border-radius: 12px;\" src=\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%27100%27%20height%3D%27352%27%20viewBox%3D%270%200%20100%20352%27%3E%3Crect%20width%3D%27100%27%20height%3D%27352%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\" data-orig-src=\"https:\/\/open.spotify.com\/embed\/episode\/5qldQvzceYJauQ8dv1H7Bm?utm_source=generator\" width=\"100%\" height=\"352\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/a>\n<div class=\"fusion-text fusion-text-3\"><h2 class=\"p1\"><span class=\"ez-toc-section\" id=\"What_is_a_protocol_and_what_is_a_framework\"><\/span>What is a protocol and what is a framework?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This distinction is crucial in order to understand the difference between OAuth 2.0 and OpenID Connect.<\/p>\n<p class=\"p1\">A <b>protocol<\/b> is an <span class=\"s1\">official specification<\/span> and defines established rules and procedures as a standard that precisely define how data is transferred and interpreted between different digital systems. Think of a protocol as a language that is understood and spoken by all parties to ensure smooth communication. If parties have agreed on an IT protocol and define this as the basis for their communication, it becomes binding and all parties must then implement this protocol in exactly the same way.<\/p>\n<p class=\"p1\">Software manufacturers who implement systems and components must therefore comply exactly with these protocol specifications.<\/p>\n<p class=\"p1\">A<b> framework <\/b>, on the other hand, provides a structured basis on which specific applications <span class=\"s1\">can<\/span> be developed. These are therefore non-binding recommendations that have proven themselves in practice. This means that a framework is far less binding than a protocol that defines an established standard. A framework also defines basic building blocks and procedures and offers reliable tools, but leaves room for individual adaptations and extensions. You can see a framework as a kind of construction kit that provides everything you need to build a house, but gives you the freedom to determine the design and furnishings yourself.<\/p>\n<p class=\"p1\"><strong>OAuth 2.0<\/strong> as defined in the<a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc6749\" target=\"_blank\" rel=\"noopener\"><br>\n<strong> RFC 6749<\/strong><br>\n<\/a> is a framework and not a complete protocol. With these two clean definitions in mind, it quickly becomes clear why OAuth 2.0 is referred to as a framework and not a protocol. It provides the basis for access authorizations, but leaves the exact structure open in order to be able to react flexibly to the needs of different applications.<\/p>\n<p class=\"p1\"><strong>OpenID Connect<\/strong>, on the other hand, is an officially standardized protocol based on the OAuth 2.0 framework. OIDC complements OAuth with specific rules and procedures for identity verification, providing a complete solution for secure authentication and identity management processes.<\/p>\n<p class=\"p1\">This clarification is not just an academic distinction, but has direct practical implications for the way we manage and protect digital identities and access rights on the Internet. By understanding the specific nature of OAuth 2.0 as a framework and OpenID Connect as the underlying standard protocol, we can better categorize and utilize the digital tools that make our online experiences safe and user-friendly.<\/p>\n<p class=\"p1\">Now that we have this distinction clearly in mind, let&rsquo;s dive further into the fascinating world of OpenID Connect and explore how it works, what benefits it offers and how it is revolutionizing the landscape of digital authentication and identity verification.<\/p>\n<\/div><div class=\"fusion-text fusion-text-4\"><h2 class=\"p1\"><span class=\"ez-toc-section\" id=\"What_exactly_does_OIDC_do_now\"><\/span>What exactly does OIDC do now?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">Think of it like a hotel key that gives you access to your room and maybe the pool, but not to the entire hotel. The basic principle is the same.<\/p>\n<p class=\"p1\">OpenID Connect builds on this framework and goes a decisive step further.<\/p>\n<p class=\"p1\">While OAuth is mainly used to manage access authorizations, OIDC adds an important component: identity verification.<\/p>\n<p class=\"p1\">It not only enables the secure exchange of access tokens that confirm that an application may perform certain actions on behalf of a user, but also provides information about the user himself. It&rsquo;s as if your hotel key not only opens doors, but also tells reception who you are.<\/p>\n<p class=\"p1\">This analogy is a good image to illustrate the role of identity verification within OpenID Connect. It helps us to visualize the additional function and value of OIDC compared to OAuth to clarify.<\/p>\n<p class=\"p1\">Technically, OIDC provides an ID token that contains the user&rsquo;s basic profile information and metadata about the authentication. This information is transmitted in a secure and verifiable form, which enables the relying parties &ndash; the services that rely on the authentication information &ndash; to reliably confirm the identity of the user.<\/p>\n<p class=\"p1\">By using OIDC, applications can therefore not only ensure that they are authorized to act on behalf of a user, but also precisely verify the user&rsquo;s identity. This step is crucial for many online services that want to provide a secure and personalized user experience by knowing who they are interacting with in a trustworthy way.<\/p>\n<p class=\"p1\">OAuth 2.0 is therefore a framework that allows us to share access authorizations between different websites and applications without disclosing our actual access data. It&rsquo;s like a kind of digital ID that says: &ldquo;Yes, this user has given me permission.&rdquo;<\/p>\n<p class=\"p1\">And this is where OpenID Connect comes into play. OIDC builds on OAuth and adds a crucial layer: identity verification. It is no longer just about what you are allowed to do, but also about who you are. OIDC allows applications to securely confirm that you are who you say you are while sharing relevant user information in a secure way.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Digital_identities_and_the_importance_of_OIDC\"><\/span>Digital identities and the importance of OIDC<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">The importance of OIDC in our networked world cannot be overestimated. It is the technical basis for many single sign-on experiences that make our digital lives easier and more secure. But with great power comes great responsibility. The security of our digital identities depends heavily on how well OIDC and the associated systems are designed and implemented.<\/p>\n<p class=\"p1\">Over the next few minutes, we will explore exactly how OpenID Connect works, what benefits it offers us and what challenges and criticisms we should reflect on carefully.<\/p>\n<p class=\"p1\">Stay tuned, because this knowledge is essential in order to shape the digital world safely and consciously.<\/p>\n<\/div><div class=\"fusion-text fusion-text-5\"><h2 class=\"p1\"><span class=\"ez-toc-section\" id=\"The_technical_components_of_OIDC\"><\/span>The technical components of OIDC<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">Let&rsquo;s look at the core components of this powerful protocol that protects and simplifies our digital identity.<\/p>\n<p class=\"p1\">Let&rsquo;s again use concise images and analogies and dive straight into the matter:<\/p>\n<h3><span class=\"ez-toc-section\" id=\"The_role_of_identity_providers\"><\/span>The role of identity providers<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p class=\"p1\">Let&rsquo;s start with the <b>identity provider<\/b>, or IdP for short.<\/p>\n<p class=\"p1\">Think of the IdP as a trustworthy bouncer at your favorite club. The doorman knows you, knows that you have access and lets you in.<\/p>\n<p class=\"p1\">In the digital space, the IdP does exactly that: it confirms your identity to other online services. Thanks to it, you don&rsquo;t have to prove who you are for every service, but simply use your digital ID, which the IdP manages. Practical, isn&rsquo;t it?<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Role_and_function_of_the_RelyingParty\"><\/span>Role and function of the Relying<b>Party <\/b><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p class=\"p1\">Now to the <b>Relying Party<\/b>. These are the clubs, the bars, the online services you want to have access to.<\/p>\n<p class=\"p1\">They rely on the statement of the bouncer, i.e. the IdP, that you are actually the person you claim to be. The Relying Party wants to ensure that only authorized guests &ndash; or in our case users &ndash; use its services.<\/p>\n<p class=\"p1\">A seamless process that harmonizes safety and comfort.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"The_end_user_and_OIDC\"><\/span>The end user and OIDC<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p class=\"p1\">And then of course there are us, the <b>end users<\/b>, the visitors to the club, the users of the Internet.<\/p>\n<p class=\"p1\">We want easy access to our favorite services without having to create a new account every time or remember dozens of passwords. OIDC gives us exactly that: a secure, fast and uncomplicated login experience.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"The_ID_token_in_the_identity_process\"><\/span>The ID token in the identity process<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p class=\"p1\">But where would we be without our <b>ID token<\/b>? Think of the ID token as your VIP wristband that you receive from the doorman.<\/p>\n<p class=\"p1\">It shows the services that you are verified and gives them the information they need to recognize and welcome you. This token is the key that unlocks the door to a seamless digital experience.<\/p>\n<p class=\"p1\">Technically speaking, this ID token is like an infinitely long combination of numbers and letters, so complex and encrypted that it is almost impossible for us humans to remember &ndash; a digital super password that meets the highest security standards and reliably protects your digital door.<\/p>\n<p class=\"p1\">In turn, this ID token is packaged as a compact, secure message that confirms your identity between the IDP and the relying party, containing both your basic profile information and the details of your authentication, similar to a QR code that is scanned when needed to prove who you are without revealing sensitive data.<\/p>\n<\/div><div class=\"fusion-text fusion-text-6\"><h3><span class=\"ez-toc-section\" id=\"The_User_Info_Endpoint\"><\/span>The User Info Endpoint<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p class=\"p1\">And last but not least, the <b>User Info Endpoint<\/b>. This is the exclusive area in which you have securely stored your personal data, accessible only to you and the services you explicitly trust.<\/p>\n<p class=\"p1\">This is where your profile information is managed, kept up to date and made available to the Relying Parties as required, always under the strictest data protection guidelines.<\/p>\n<p class=\"p1\">Together, these components form the backbone of OpenID Connect, a system designed to make our digital world more secure and user-friendly. However, as with any technology, there are challenges and points of criticism that need to be considered. But we&rsquo;ll come to that later.<\/p>\n<p class=\"p1\">For now, let&rsquo;s just say that OpenID Connect is much more than just a protocol; it&rsquo;s a foundation for secure digital identities in our connected world.<\/p>\n<p class=\"p1\">Now, we have already developed a solid understanding of the mechanisms of OpenID Connect. Let&rsquo;s take a brief look at the question:<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_is_OIDC_changing_our_digital_lives_and_what_benefits_does_it_bring_us\"><\/span>How is OIDC changing our digital lives and what benefits does it bring us?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">What does all this mean in practice? How is OIDC changing our digital lives and what benefits does it bring us?<\/p>\n<p class=\"p1\">As users, we are constantly navigating through the vast sea of digital services &ndash; from social networks and online shopping to our online banking.<\/p>\n<p class=\"p1\">Thanks to OIDC, we could cross this digital ocean with a single, secure identity. In practice, however, regulations stand in the way of this, so that a single identity does not meet the level of trust required for secure online banking.<\/p>\n<p class=\"p1\">But for the vast majority of services, there is no need to create and remember dozens of passwords, and there is no need to constantly log in and out if we want to. Once authenticated, the digital world opens up as if by magic.<\/p>\n<p class=\"p1\">Let&rsquo;s take access to your photo <a href=\"https:\/\/rock-the-prototype.com\/en\/learn-programming\/library\/\" target=\"_blank\" title=\"A library refers to a software library as a ready-made collection of code that can be used to perform general software development tasks. Libraries are essentially a collection of functions and procedures that can be called up by other software programs to execute certain functions.\" class=\"encyclopedia\">library<\/a> as a concrete example to illustrate the differences between OAuth 2.0 and OpenID Connect:<\/p>\n<p class=\"p1\">Imagine you want to use a service that requires access to your photos stored on a <a href=\"https:\/\/rock-the-prototype.com\/en\/cloud-computing-cloud-technology\/cloud\/\" target=\"_blank\" title=\"What is cloud? Cloud or cloud computing moves data and programs from desktop PCs or servers in a company to remote cloud servers. Cloud storage therefore consists of a standard server network in a cloud data center or distributed across several cloud server locations.\" class=\"encyclopedia\">cloud<\/a> service.<\/p>\n<\/div><div class=\"fusion-text fusion-text-7\"><h2><span class=\"ez-toc-section\" id=\"Interaction_of_OIDC_and_OAuth_20\"><\/span>Interaction of OIDC and OAuth 2.0<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">This is where OAuth 2.0 comes into play: it allows the photo service to receive an <a href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/access-token\/\" target=\"_blank\" title=\"What is an access token? Access tokens are digital keys that allow a client access to protected server resources as soon as a user is successfully authenticated. You should definitely be familiar with these tokens as an integral part of the OAuth 2.0 specification, as they are used for secure authorization. Learn more about software development and IT security now...\" class=\"encyclopedia\">access token<\/a> after you have given your consent, with which this service can access your photo library without having to disclose your identity or other personal data.<\/p>\n<p class=\"p1\">The service only receives authorization to download the photos based on the access rights you have granted.<\/p>\n<p class=\"p1\">Now to OpenID Connect: If you create an account or log in to this photo service, OIDC can be used for the authentication process. It goes beyond the pure authorization management of OAuth 2.0 and enables the photo service to securely verify your identity in addition to your access rights. This means that OIDC allows the photo service to know not only that someone has given permission, but also who that someone is &ndash; provided, of course, that you have consented to this information being passed on.<\/p>\n<p class=\"p1\">In this scenario, OAuth 2.0 and OIDC work hand in hand: OAuth 2.0 takes care of securely providing access tokens for the photo service to access the photos, while OIDC provides a secure way to authenticate your identity as part of the sign-in or account creation process.<\/p>\n<p class=\"p1\">This distinction is essential to understand the respective roles of OAuth 2.0 and OpenID Connect in the digital authentication ecosystem. While OAuth 2.0 provides the foundation for secure access to resources, OIDC adds the important component of user authentication, enabling a more comprehensive and secure user experience.<\/p>\n<p class=\"p1\">Instead of creating a new account for each service and disclosing your data each time, OpenID Connect allows you to log in more easily, for example via your existing email account, which acts as an identity provider. With a single click &ndash; and of course only with your express consent &ndash; you can send the new service the information required for authentication and any authorizations.<\/p>\n<p class=\"p1\">This is done using OAuth 2.0, which enables the secure transfer of access tokens without passing on your actual access data, while OIDC also verifies your identity. This allows you to keep control of your personal information while enjoying seamless access to new services.<\/p>\n<p class=\"p1\">The real advantage of OIDC lies in the balance between convenience and data protection. For us users, this means a significant simplification of everyday digital life: fewer worries about passwords and greater control over our personal data. OIDC enables secure and trustworthy authentication by verifying the user&rsquo;s identity and increasing user-friendliness at the same time.<\/p>\n<p class=\"p1\">Service providers, in turn, benefit from a reduced drop-out rate during registration and a simplified onboarding process, as users can access their services more easily and securely.<\/p>\n<p class=\"p1\">By building on the OAuth 2.0 framework and adding the important layer of identity verification, OpenID Connect creates a digitally connected ecosystem that is both user-friendly and secure. It allows us to conveniently and securely access a variety of services with a single, verified digital identity without compromising the privacy and security of our data.<\/p>\n<\/div><div class=\"fusion-text fusion-text-8\"><p class=\"p1\">But we are not the only ones to benefit. New opportunities are also opening up for service providers. They can offer secure, seamless user experiences while relying on compliance with data protection standards and lowering the barrier to entry to using their service. By reducing barriers to registration, they can increase user loyalty and attract new customers.<\/p>\n<p class=\"p1\">In a world where digital services are becoming increasingly intertwined, OpenID Connect provides the necessary infrastructure to manage this complexity for all parties involved.<\/p>\n<p class=\"p1\">It&rsquo;s as if we were all part of a large, well-organized digital ecosystem in which everyone knows their place and respects the rules of fair play.<\/p>\n<p class=\"p1\">So, my dears, those were the practical application scenarios and the unbeatable advantages of OpenID Connect.<\/p>\n<p class=\"p1\">Keep your digital sails to the wind, because in the next part of our podcast, we&rsquo;ll continue to navigate the deep waters of digital identities and set course for challenges and how we can tackle them effectively. How we avoid these pitfalls is just as exciting, so stay on course!<\/p>\n<p class=\"p1\">We have now taken an in-depth look at the strengths of OpenID Connect, how it simplifies our digital lives and how it benefits providers and users alike. But where there is light, there is also shadow. It is time to address the challenges and critical voices that exist around OIDC.<\/p>\n<p class=\"p1\">In the digital world, security and data protection are not just buzzwords, but absolute cornerstones. With the increase in single sign-on services and the central role of identity providers, the question arises: How secure are our digital identities really?<\/p>\n<p class=\"p1\">OIDC sets high security standards, but no system is infallible. Cyberattacks are becoming increasingly sophisticated, and the concentration of access rights with a single identity provider could have far-reaching consequences if that provider is compromised.<\/p>\n<p class=\"p1\">With the simplification of access through services such as OIDC, the concerns of those who advocate security and data protection are justifiably growing at the same time.<\/p>\n<p class=\"p1\">It&rsquo;s like sailing on the high seas: the faster our ship is and the more technical equipment we have on board, the more important it is that we have the right quality and safety measures on board.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Open_ID_Connect_and_the_Zero_Trust_concept\"><\/span>Open ID Connect and the Zero Trust concept<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p class=\"p1\">This is where the concept of Zero Trust comes into play. A Zero Trust architecture provides a basic framework and rules that offer strong protection and effective damage limitation.<\/p>\n<p class=\"p1\">Imagine your ship was designed to distrust every other ship at sea, no matter how harmless they may seem.<\/p>\n<p class=\"p1\">In our current geopolitical situation, this is unfortunately an all too realistic scenario, and it applies all the more to our digital world. Well, then this means that we don&rsquo;t trust any device, application or network per se, even if they are within our own digital &ldquo;fleet&rdquo;.<\/p>\n<p class=\"p1\">Zero Trust relies on a continuous review of every request that comes into our system. This means that even if an attacker gains access to part of our digital identity, the damage remains limited because any attempt to penetrate deeper into the system is immediately met with resistance.<\/p>\n<p class=\"p1\">It&rsquo;s as if every room on our ship is equipped with its own independent security bulkhead that can only be opened with the right key.<\/p>\n<p class=\"p1\">This ongoing verification and the requirement for explicit authorization for each access is crucial to ensure the security of our digital identities in an ecosystem that is increasingly interconnected through OIDC and similar technologies.<\/p>\n<p class=\"p1\">By turning to the Zero Trust approach, we recognize that in the digital world, trust is something that constantly deserves to be tested and verified and should never be taken for granted. It&rsquo;s a strategic decision that fundamentally changes the way we think about security and data protection and better equips us against the ever-growing and evolving threats.<\/p>\n<p class=\"p1\">While OpenID Connect opens the doors to a simpler and more seamless digital life, Zero Trust reminds us that we should always open these doors with caution and constant vigilance.<\/p>\n<\/div><div class=\"fusion-text fusion-text-9\"><p class=\"p1\">As we sail the digital seas with the help of OpenID Connect and the convenience of single sign-on, we must never forget that the waters we navigate are always buffeted by the storms of potential cyber threats.<\/p>\n<p class=\"p1\">But there is another element that requires our attention: the fine art of consent:<\/p>\n<p class=\"p1\">OpenID Connect enables the Relying Parties with whom we register to request selected information about us from our Identity Provider. Caution is advised here! We should always be careful not to disclose more information than is absolutely necessary. We should be particularly critical of relying parties that, in our opinion, request too much data.<\/p>\n<p class=\"p1\">Unfortunately, not all identity providers allow us to deselect individual requested attributes in the consent request, even though OIDC technically offers precisely this option to individually agree scope values and claims. In such cases, if we are of the opinion that a relying party requires too much information from us, we are faced with the decision to completely reject the registration via our IdP.<\/p>\n<p class=\"p1\">This important point may seem like a side note at this point, but it is precisely this aspect that puts the spotlight on the individual control we should have over the consent process and our consent management. We may revisit this very important aspect as a separate topic in a future podcast episode, particularly in the context of digital wallets, where it is crucial that we, the users, should have far greater control over the consent process.<\/p>\n<p class=\"p1\">So let&rsquo;s continue to set the sails of digital identity with caution and prudence, always aware of what information we share and which services we trust. Because in the world of digital identities, the right level of consent is not just a question of convenience, but above all one of security and data protection.<\/p>\n<\/div><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.iTunes - Folge 15 - OpenID Connect - Ein Schl&uuml;ssel zu digitalen Identit&auml;ten - Rock the Prototype - Softwareentwicklung &amp; Prototyping\" href=\"#\"><iframe style=\"width: 100%; max-width: 660px; overflow: hidden; border-radius: 10px;\" src=\"https:\/\/embed.podcasts.apple.com\/us\/podcast\/folge-15-openid-connect-ein-schl%C3%BCssel-zu-digitalen\/id1684107786?i=1000647345551\" height=\"175\" frameborder=\"0\" sandbox=\"allow-forms allow-popups allow-same-origin allow-scripts allow-storage-access-by-user-activation allow-top-navigation-by-user-activation\"><\/iframe><\/a>\n<div class=\"fusion-text fusion-text-10\"><p class=\"p1\">The Zero Trust approach reminds us to always be vigilant, open our digital doors with care and caution and never let go of the reins when it comes to the security of our digital identity. It&rsquo;s a journey that requires both courage and prudence, but with the right tools and a clear navigation strategy, we can safely navigate the digital world without compromising our security and privacy.<\/p>\n<p class=\"p1\">Another hotly debated topic is data protection and data sovereignty.<\/p>\n<p class=\"p1\">Yes, OIDC allows us to retain control over the disclosure of our data, but how transparent and traceable is this process really?<\/p>\n<p class=\"p1\">Who can guarantee that the data will not be used or passed on for other purposes? At a time when data is the new gold, this question is more relevant than ever.<\/p>\n<p class=\"p1\">Dealing with these challenges requires constant further development of security mechanisms and an open dialog between all parties involved: developers, providers, users and, of course, the regulatory authorities.<\/p>\n<p class=\"p1\">It&rsquo;s about finding a balance between the convenience that OIDC undoubtedly offers and the essential requirements of security and data protection.<\/p>\n<p class=\"p1\">Only if we critically reflect on technical implementations and work together to ensure that our digital world is not only more convenient but also more secure and that data protection and data sovereignty are equally safeguarded will we find perfect digital identities. Because one thing is clear: digital identity is a valuable asset that must be protected.<\/p>\n<p class=\"p1\">In this context, the certificate-based digital infrastructure, in particular X.509 certificates, is becoming the focus of discussion.<\/p>\n<p class=\"p1\">It currently looks as if our future security of digital identities will be based on a certificate-based digital infrastructure, especially in the context of X.509 certificates.<\/p>\n<p class=\"p1\">The implementation and management of X.509 certificates in large, distributed systems poses significant challenges. The revocation process, i.e. the revocation of certificates, is a critical element that significantly influences the security of the entire infrastructure. Effective and agile handling of this process is crucial to prevent security gaps. This raises the question of whether a centralized or decentralized organization of certificate revocation is more expedient, whereby decentralized approaches have the potential to seamlessly integrate Zero Trust mechanisms.<\/p>\n<p class=\"p1\">However, the use of X.509 certificates is associated with further concerns. Constantly updating and adapting the PKI to current requirements requires considerable effort. The costs of obtaining and managing these certificates are not negligible, especially for public institutions. In addition, protection against misuse and manipulation must be critically scrutinized, as the assumption that certificate-based attributes automatically offer better protection can be deceptive.<\/p>\n<p class=\"p1\">In this context, open source alternatives and approaches without X.509 certificates are gaining in importance. They open up the possibility of meeting security and trust requirements in other ways and challenge us to critically rethink existing infrastructures.<\/p>\n<p class=\"p1\">Auguste Kerckhoff&rsquo;s principle that the security of a system should not be based on the secrecy of its operation is particularly relevant in the context of Public Key Infrastructure (PKI), which includes X.509 certificates. Adherence to this principle supports transparency, security by design, adaptability and future-proofing as well as broad acceptance and interoperability.<\/p>\n<p class=\"p1\">The evaluation and definition of security procedures by recognized authorities, such as the German Federal Office for Information Security (BSI), play a central role in creating a framework of trust for the use of X.509 certificates.<\/p>\n<p class=\"p1\">Through their audits, these institutions ensure that the implemented systems not only comply with current standards, but are also robust against new threats.<\/p>\n<p class=\"p1\">Only through critical reflection, a well-planned and validated architecture and continuous improvement of technical implementations and organizational frameworks can a digital world be created that is not only more convenient, but also more secure.<\/p>\n<p class=\"p1\">The balance between data protection and data sovereignty must always be maintained in order to effectively protect the precious asset of our digital identity.<\/p>\n<p class=\"p1\">The certificate-based digital infrastructure and in particular the use of X.509 certificates play a central role here, but require careful consideration of the associated challenges &ndash; for example with dynamic IP addresses &ndash; and actual potential.<\/p>\n<p class=\"p1\">Only if we critically reflect on technical implementations and work together to ensure that our digital world is not only more convenient but also more secure, and that data protection and data sovereignty are equally safeguarded, will we realize trust-based infrastructures and trust services. Because one thing is clear: digital identity is a valuable asset that must be protected.<\/p>\n<p class=\"p1\">That&rsquo;s why at least one more security anchor, which we can use as an additional factor via an authenticator app such as the one from google, is a sensible and very effective protective measure that I personally wouldn&rsquo;t want to do without for payments via Paypal, digital identities such as my <a href=\"https:\/\/rock-the-prototype.com\/en\/software-development\/github\/\" target=\"_blank\" title=\"What is GitHub? GitHub is a cloud-based platform for versioning software based on Git versioning. GitHub online repositories are very popular and therefore widely used. GitHub is a version control system\" class=\"encyclopedia\">GitHub<\/a> account and in many other places.<\/p>\n<p>Each of us has to decide for ourselves on the balance between convenient usability and our own level of protection. OIDC offers us all the necessary options, provided that the apps and software we use also make sensible and responsible use of these functions and fully support these important functions. And that is exactly the point. This is exactly what software quality is all about, which we would like to introduce to you under the title<\/p>\n<h2 class=\"p3\">IT standards &ndash; Why interoperability and security are essential<\/h2>\n<p class=\"p1\">on the Rock the Prototype YouTube Channel with a brand new info video.<\/p>\n<\/div><div class=\"fusion-video fusion-youtube\" style=\"--awb-max-width:1200px;--awb-max-height:675px;--awb-align-self:center;--awb-width:100%;\"><div class=\"video-shortcode\"><priv-fac-lite-youtube class=\"fusion-hidden lty-load\" data-privacy-type=\"youtube\" videoid=\"TMAyK4FC4YU\" params=\"wmode=transparent&amp;autoplay=1&amp;enablejsapi=1\" title=\"IT-Standards &ndash; Warum Interoperabilit&auml;t und Sicherheit unverzichtbar sind\" data-button-label=\"Play Video\" width=\"1200\" height=\"675\" data-thumbnail-size=\"auto\" data-no-cookie=\"on\"><\/priv-fac-lite-youtube><div class=\"fusion-privacy-placeholder\" style=\"width:1200px; height:675px;\" data-privacy-type=\"youtube\"><div class=\"fusion-privacy-placeholder-content\"><div class=\"fusion-privacy-label\">For privacy reasons YouTube needs your permission to be loaded. For more details, please see our <a class=\"privacy-policy-link\" href=\"https:\/\/rock-the-prototype.com\/datenschutzerklaerung\/\" rel=\"privacy-policy\">Datenschutzerkl&auml;rung<\/a>.<\/div><button data-privacy-type=\"youtube\" class=\"fusion-button button-default fusion-button-default-size button fusion-privacy-consent\">I Accept<\/button><\/div><\/div><\/div><\/div><div class=\"fusion-text fusion-text-11\"><p class=\"p1\">We have also already dedicated a <strong>podcast episode<\/strong> to the <strong>Zero Trust principle<\/strong>, which you should definitely listen to.<\/p>\n<p class=\"p1\">Don&rsquo;t forget to tune in again for our next episode. An exciting interview awaits you. We delve deeper into the history and future vision of this revolutionary technology with the specifiers and architects behind OpenID.<\/p>\n<p class=\"p1\">Please support us by subscribing to our podcast &amp; YouTube channel and of course we also appreciate your feedback, comments and likes!<\/p>\n<p class=\"p1\">Until then, stay safe, creative and above all curious!<\/p>\n<p class=\"p1\">Your Sascha Block<\/p>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-2 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-1 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.Rock the Prototype - Softwareentwicklung &amp; Prototyping Podcast iTunes\" href=\"#\"><iframe id=\"embedPlayer\" style=\"width: 100%; max-width: 990px; overflow: hidden; border-radius: 10px; transform: translateZ(0px); animation: 2s ease 0s 6 normal none running loading-indicator; background-color: #e4e4e4;\" src=\"https:\/\/embed.podcasts.apple.com\/de\/podcast\/rock-the-prototype-softwareentwicklung-prototyping\/id1684107786?itsct=podcast_box_player&amp;itscg=30200&amp;ls=1&amp;theme=dark\" height=\"450px\" frameborder=\"0\" sandbox=\"allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation-by-user-activation\"><\/iframe> <\/a><\/div><\/div><\/div><\/div>\n<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-3 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-2 fusion_builder_column_1_3 1_3 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:33.333333333333%;--awb-margin-top-large:0px;--awb-spacing-right-large:5.76%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:5.76%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-1 fusion-sep-none fusion-title-text fusion-title-size-two\" style=\"--awb-margin-top-small:30px;--awb-margin-right-small:0px;--awb-margin-bottom-small:20px;--awb-margin-left-small:0px;\"><h2 class=\"fusion-title-heading title-heading-left fusion-responsive-typography-calculated\" style=\"margin:0;--fontSize:30;line-height:1.1;\">About the Author:<\/h2><\/div><div class=\"fusion-image-element\" style=\"--awb-caption-title-font-family:var(--h2_typography-font-family);--awb-caption-title-font-weight:var(--h2_typography-font-weight);--awb-caption-title-font-style:var(--h2_typography-font-style);--awb-caption-title-size:var(--h2_typography-font-size);--awb-caption-title-transform:var(--h2_typography-text-transform);--awb-caption-title-line-height:var(--h2_typography-line-height);--awb-caption-title-letter-spacing:var(--h2_typography-letter-spacing);\"><span class=\" fusion-imageframe imageframe-none imageframe-1 hover-type-none\"><img decoding=\"async\" width=\"1920\" height=\"1920\" title=\"Sascha Block &ndash; Rock the Prototype\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block.jpg\" alt class=\"img-responsive wp-image-3342\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-200x200.jpg 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-400x400.jpg 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-600x600.jpg 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-800x800.jpg 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-1200x1200.jpg 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block.jpg 1920w\" sizes=\"(max-width: 1024px) 100vw, (max-width: 640px) 100vw, 400px\"><\/span><\/div><\/div><\/div><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-3 fusion_builder_column_2_3 2_3 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:66.666666666667%;--awb-margin-top-large:0px;--awb-spacing-right-large:2.88%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:2.88%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-2 fusion-sep-none fusion-title-text fusion-title-size-three\" style=\"--awb-margin-top-small:30px;--awb-margin-right-small:0px;--awb-margin-bottom-small:20px;--awb-margin-left-small:0px;\"><h3 class=\"fusion-title-heading title-heading-left fusion-responsive-typography-calculated\" style=\"margin:0;--fontSize:26;line-height:1.2;\">Sascha Block<\/h3><\/div><div class=\"fusion-text fusion-text-12\"><p>I am <a href=\"https:\/\/www.linkedin.com\/in\/sascha-block-5785b9126\/\">Sascha Block<\/a> &ndash; IT architect in Hamburg and the initiator of Rock the Prototype. I want to make <a href=\"https:\/\/rock-the-prototype.com\/en\/prototyping-en\/prototyping\/\" target=\"_blank\" title=\"What is prototyping? Prototyping is both a process and a strategy for realizing ideas as quickly as possible.\" class=\"encyclopedia\">prototyping<\/a> learnable and experiential. With the motivation to prototype ideas and share knowledge around software prototyping, software architecture and <a href=\"https:\/\/rock-the-prototype.com\/en\/learn-programming\/programming\/\" target=\"_blank\" title=\"What is programming? When programming, a programmer creates a software program that can run on a machine. The code is created in one of the formally defined computer languages - which are countless, such as Java, PHP, C++ or C#, Perl and many many more.\" class=\"encyclopedia\">programming<\/a>, I created the format and the open source initiative Rock the Prototype.<\/p>\n<\/div><div><a class=\"fusion-button button-flat fusion-button-default-size button-default fusion-button-default button-1 fusion-button-default-span fusion-button-default-type\" target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\/\/rock-the-prototype.com\/programmieren-lernen\/strategien-zur-code-optimierung-und-algorithmen-effizienz-beispiele-best-practices\/\"><span class=\"fusion-button-text awb-button__text awb-button__text--default\">Strategies for code optimization and algorithm efficiency: examples &amp; best practices<\/span><\/a><\/div><div class=\"fusion-separator fusion-full-width-sep\" style=\"align-self: center;margin-left: auto;margin-right: auto;width:100%;\"><\/div><ul style=\"--awb-line-height:23.8px;--awb-icon-width:23.8px;--awb-icon-height:23.8px;--awb-icon-margin:9.8px;--awb-content-margin:33.6px;--awb-circlecolor:var(--awb-color3);--awb-circle-yes-font-size:12.32px;\" class=\"fusion-checklist fusion-checklist-1 fusion-checklist-default type-icons\"><li class=\"fusion-li-item\" style=\"\"><span class=\"icon-wrapper circle-yes\"><i class=\"fusion-li-icon fa-link fas\" aria-hidden=\"true\"><\/i><\/span><div class=\"fusion-li-item-content\">\n<p><a href=\"https:\/\/rock-the-prototype.com\/en\/\">rock-the-prototype.com<\/a><\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>With OpenID Connect, we delve deeper into the world of authentication and identity verification and shed light on OpenID Connect &#8211; or OIDC for short. This protocol is at the heart of modern digital identity systems and enables us to access a wide range of digital services securely and efficiently. But what makes OpenID so special and why is it indispensable for digital identity management?<\/p>\n","protected":false},"author":1,"featured_media":4763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"footnotes":""},"categories":[1232,1166,1141],"tags":[1255,2510,2279,2506,2057,2502,2508,1340,2509,2280,2505,1356,1337,1235,2497,2511,1343,2499,1349,1170,2498,2500,2501,2324,1148,1268,2504,2503,1239,2507],"class_list":["post-4755","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-security","category-software-architecture","category-software-development","tag-authentication","tag-authentificator-app-en","tag-bsi-en","tag-consent-management-en","tag-data-integrity-en","tag-digital-certificates","tag-digital-data-protection","tag-digital-identity","tag-digital-identity-management","tag-federal-office-for-information-security","tag-id-token-en","tag-identity-provider-en","tag-interoperability","tag-it-security-en","tag-oauth-2-0-en","tag-oidc-en","tag-openid-connect-en","tag-pki-en","tag-privacy","tag-prototyping-en","tag-public-key-infrastructure-en","tag-relying-party-en","tag-safety-standards","tag-single-sign-on-en","tag-software-development","tag-software-quality","tag-user-info-endpoint-en","tag-x-509-certificates","tag-zero-trust-en","tag-zero-trust-architecture"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping<\/title>\n<meta name=\"description\" content=\"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping\" \/>\n<meta property=\"og:description\" content=\"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/\" \/>\n<meta property=\"og:site_name\" content=\"Rock the Prototype - Softwareentwicklung &amp; Prototyping\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-02T19:51:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-03T08:05:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1792\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sascha Block\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@rocktheprototyp\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sascha Block\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"26 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/\"},\"author\":{\"name\":\"Sascha Block\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\"},\"headline\":\"OpenID Connect &#8211; A key to digital identities\",\"datePublished\":\"2024-03-02T19:51:55+00:00\",\"dateModified\":\"2024-03-03T08:05:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/\"},\"wordCount\":8681,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/OpenID-Connect-Key-to-digital-identities.jpg\",\"keywords\":[\"Authentication\",\"Authentificator App\",\"BSI\",\"Consent Management\",\"Data integrity\",\"digital certificates\",\"Digital data protection\",\"digital identity\",\"Digital identity management\",\"Federal Office for Information Security\",\"ID token\",\"Identity Provider\",\"Interoperability\",\"IT Security\",\"OAuth 2.0\",\"OIDC\",\"OpenID Connect\",\"PKI\",\"Privacy\",\"Prototyping\",\"Public Key Infrastructure\",\"Relying Party\",\"Safety standards\",\"Single Sign-On\",\"Software development\",\"Software quality\",\"User Info Endpoint\",\"X.509 certificates\",\"Zero Trust\",\"Zero Trust Architecture\"],\"articleSection\":[\"IT Security\",\"Software Architecture\",\"Software development\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/\",\"name\":\"OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/OpenID-Connect-Key-to-digital-identities.jpg\",\"datePublished\":\"2024-03-02T19:51:55+00:00\",\"dateModified\":\"2024-03-03T08:05:49+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\"},\"description\":\"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#primaryimage\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/OpenID-Connect-Key-to-digital-identities.jpg\",\"contentUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/OpenID-Connect-Key-to-digital-identities.jpg\",\"width\":1792,\"height\":1024,\"caption\":\"OpenID Connect - Key to digital identities\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/openid-connect-a-key-to-digital-identities\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/rock-the-prototype\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenID Connect &#8211; A key to digital identities\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/\",\"name\":\"Rock the Prototype - Softwareentwicklung &amp; Prototyping\",\"description\":\"Prototyping: Software Prototypen, Software entwickeln &amp; Programmieren im Team\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\",\"name\":\"Sascha Block\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"caption\":\"Sascha Block\"},\"description\":\"Ich bin Sascha Block \u2013 IT-Architekt in Hamburg und der Initiator von Rock the Prototype. Ich m\u00f6chte Prototyping erlernbar und erfahrbar machen. Mit der Motivation Ideen prototypisch zu verwirklichen und Wissen rund um Software-Prototyping, Softwarearchitektur und Softwareentwicklung zu teilen, habe ich das Format und die Open-Source Initiative Rock the Prototype geschaffen.\",\"sameAs\":[\"https:\\\/\\\/rock-the-prototype.com\",\"https:\\\/\\\/www.instagram.com\\\/rock_the_prototype\\\/\",\"https:\\\/\\\/x.com\\\/rocktheprototyp\",\"https:\\\/\\\/www.youtube.com\\\/@Rock-the-Prototype\\\/\"],\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/author\\\/administrator-2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping","description":"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/","og_locale":"en_US","og_type":"article","og_title":"OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping","og_description":"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...","og_url":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/","og_site_name":"Rock the Prototype - Softwareentwicklung &amp; Prototyping","article_published_time":"2024-03-02T19:51:55+00:00","article_modified_time":"2024-03-03T08:05:49+00:00","og_image":[{"width":1792,"height":1024,"url":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg","type":"image\/jpeg"}],"author":"Sascha Block","twitter_card":"summary_large_image","twitter_creator":"@rocktheprototyp","twitter_misc":{"Written by":"Sascha Block","Est. reading time":"26 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#article","isPartOf":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/"},"author":{"name":"Sascha Block","@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081"},"headline":"OpenID Connect &#8211; A key to digital identities","datePublished":"2024-03-02T19:51:55+00:00","dateModified":"2024-03-03T08:05:49+00:00","mainEntityOfPage":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/"},"wordCount":8681,"commentCount":0,"image":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#primaryimage"},"thumbnailUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg","keywords":["Authentication","Authentificator App","BSI","Consent Management","Data integrity","digital certificates","Digital data protection","digital identity","Digital identity management","Federal Office for Information Security","ID token","Identity Provider","Interoperability","IT Security","OAuth 2.0","OIDC","OpenID Connect","PKI","Privacy","Prototyping","Public Key Infrastructure","Relying Party","Safety standards","Single Sign-On","Software development","Software quality","User Info Endpoint","X.509 certificates","Zero Trust","Zero Trust Architecture"],"articleSection":["IT Security","Software Architecture","Software development"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/","url":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/","name":"OpenID Connect - A key to digital identities - Rock the Prototype - Softwareentwicklung &amp; Prototyping","isPartOf":{"@id":"https:\/\/rock-the-prototype.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#primaryimage"},"image":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#primaryimage"},"thumbnailUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg","datePublished":"2024-03-02T19:51:55+00:00","dateModified":"2024-03-03T08:05:49+00:00","author":{"@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081"},"description":"OIDC for secure digital identities \u2705 OpenID Connect in combination with OAuth 2.0 \u2705 Meaning and functionality of OIDC \u2705 Now more...","breadcrumb":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#primaryimage","url":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg","contentUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2024\/03\/OpenID-Connect-Key-to-digital-identities.jpg","width":1792,"height":1024,"caption":"OpenID Connect - Key to digital identities"},{"@type":"BreadcrumbList","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/openid-connect-a-key-to-digital-identities\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/rock-the-prototype.com\/en\/rock-the-prototype\/"},{"@type":"ListItem","position":2,"name":"OpenID Connect &#8211; A key to digital identities"}]},{"@type":"WebSite","@id":"https:\/\/rock-the-prototype.com\/en\/#website","url":"https:\/\/rock-the-prototype.com\/en\/","name":"Rock the Prototype - Softwareentwicklung &amp; Prototyping","description":"Prototyping: Software Prototypen, Software entwickeln &amp; Programmieren im Team","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rock-the-prototype.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081","name":"Sascha Block","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","caption":"Sascha Block"},"description":"Ich bin Sascha Block \u2013 IT-Architekt in Hamburg und der Initiator von Rock the Prototype. Ich m\u00f6chte Prototyping erlernbar und erfahrbar machen. Mit der Motivation Ideen prototypisch zu verwirklichen und Wissen rund um Software-Prototyping, Softwarearchitektur und Softwareentwicklung zu teilen, habe ich das Format und die Open-Source Initiative Rock the Prototype geschaffen.","sameAs":["https:\/\/rock-the-prototype.com","https:\/\/www.instagram.com\/rock_the_prototype\/","https:\/\/x.com\/rocktheprototyp","https:\/\/www.youtube.com\/@Rock-the-Prototype\/"],"url":"https:\/\/rock-the-prototype.com\/en\/author\/administrator-2\/"}]}},"_links":{"self":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/4755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/comments?post=4755"}],"version-history":[{"count":9,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/4755\/revisions"}],"predecessor-version":[{"id":4766,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/4755\/revisions\/4766"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/media\/4763"}],"wp:attachment":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/media?parent=4755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/categories?post=4755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/tags?post=4755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}