OIDC

OpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.

WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.

OAuth 2.0专门处理授权委托，OpenID Connect在OAuth 2.0之上叠加身份验证层，SAML多用于企业联邦身份场景

google-github-actions/auth Action 专门负责处理 OIDC 认证流程，而 setup-gcloud 负责配置工具环境，两者分工协作

Google 于2021年推出 Workload Identity Federation（工作负载身份联合），允许 GitHub Actions 工作流通过 OIDC 令牌直接换取 GCP 访问凭证

SSO implementation typically relies on standard protocols such as SAML or OIDC, integrating with enterprise identity providers such as Okta, Azure AD, and Google Workspace.

The OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.

OAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.

In the npm ecosystem, a common automated release practice is to let the pipeline automatically execute npm publish via OIDC or a publishing token, thereby reducing mistakes caused by manual operations.

OIDC (OpenID Connect) is built on top of OAuth 2.0, uses JSON and JWT, is more lightweight and easier to debug, and is gradually replacing SAML as the first choice for new projects.

One of WorkOS's core values is encapsulating the complexity of supporting multiple SSO protocols (SAML, OIDC, etc.) into an API that developers can quickly integrate.

Implementing conditional access usually requires the identity provider (IdP) to support claim extensions such as acr and amr in SAML/OIDC, and to be able to pass policy decision results to the application.

Google usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.

Codex Cloud adds OIDC support to facilitate access to cloud resources via OIDC.

The OIDC (OpenID Connect) release mechanism remains unchanged in this patch and is the standard solution for keyless authentication in modern CI/CD pipelines.

In the PyPI release scenario, CI environments such as GitHub Actions can use OIDC tokens to prove to PyPI that a release action originates from a trusted code repository, without needing to store long-lived API tokens.

One should not attempt to cover all scenarios with a single authentication method, as SigV4, API keys, and OIDC each have their own applicable boundaries.

For environments outside AWS (other clouds, on-premises data centers, third-party systems), OIDC federated identity authentication is recommended.

In AWS OIDC federated identity scenarios, external workloads submit the JWT obtained from their identity provider to STS's AssumeRoleWithWebIdentity interface in exchange for temporary credentials.

Keycloak, as an intermediary layer, can simultaneously support connecting to upstream SAML IdPs and issuing OIDC tokens to downstream applications, making SAML invisible to the application side.