Google open id connect

Question

I'm trying to secure my endpoint using open Id connect. Currently there is only a mobile app client. With Google as the Identity provider, I have Id_token and access_token.

My question is can I use this access token returned as a part of authentication to authorize user to access my endpoint? If yes, Is there a way to validate the access token within my server?

Or Should I create an access token for the user and store the same, so that when the user requests, I will check in the DB/Redis ?

Answer 1

As @jwilleke mentioned, OAuth2.0 doesn't specify a way in which an access token can be validated with Authorization server.

Hence the approach that I took was to verify the JWT Id token by checking the signature of it and storing the access token returned along with it.

Answer 2

OpenID connect is an Authentication layer on top of the "Authorization" framework OAuth 2.0. So the Access Token is the "Authorization" for the OAuth Client to access the resource.

Perhaps this post may help.