What belongs to the OpenID Connect protocol suite besides the core protocol?
Discovery (how OpenID Providers can be used dynamically), Dynamic Client Registration, Session Management including logout, and Form Post Response Mode, all built on underpinnings from OAuth 2.0 and the JOSE family (JWT, JWS, JWE, JWK, JWA) plus WebFinger.
* Nested profiles: Minimal is Core alone, Dynamic adds Discovery and Registration, Complete adds Session Management and Form Post. *
| Specification | What it defines |
|---|---|
| Core | The authentication flows, the ID token, the UserInfo endpoint and standard claims. Enough for a minimal implementation. |
| Discovery | How a client finds an OP's endpoints and keys automatically, so OPs can be used dynamically. |
| Dynamic Client Registration | How a client registers itself at an OP through an API instead of a manual form. |
| Session Management | How RPs learn about the user's session at the OP, including logout (later split into separate logout specifications). |
| Form Post Response Mode | Returning the response as an auto-submitted HTML form (POST) instead of URL parameters. |
The underpinnings show what OIDC reuses rather than reinvents: OAuth 2.0 Core, Bearer tokens, Assertions, the JWT Profile and Multiple Response Types; JWT (token format), JWS (signatures), JWE (encryption), JWK (key format), JWA (algorithms); and WebFinger (finding a user's provider from an identifier like an email address).
Go deeper:
OpenID Foundation: How OpenID Connect Works — the suite of specifications and their relationship.- OAuth 2.0 Form Post Response Mode — the short specification for returning responses as a POST.