'OAuth / OIDC - How to inform a resource server about a user's identity
I want to implement OAuth / OIDC into my system. I would have a central OpenID Provider and multiple Resource Servers. Each of these resource servers need to know which user they are talking to. For this, they require the user's ID.
My first instinct was to pass the ID token to the resource server, but everywhere I looked, I read that this is a bad Idea and generally not how things are done.
The next idea was to store that data in the Access Token. The OAuth standard says, that that token is opaque to the client (but not necessarily to the resource server). Does that mean, that storing a user ID in the access token is the way to go or is there a better alternative?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|