What is OpenID Connect (OIDC), and what does it enable that OAuth alone does not?

An authentication and identity layer on top of OAuth 2.0: it lets clients verify the user's identity, obtain information about the user and thereby establish login sessions, with all information exchanged as JSON objects (JWTs).

OpenID Connect 1.0 (final in 2014) reuses the entire OAuth machinery (redirects, authorization codes, the token endpoint, access tokens) and adds three things:

• Identity verification: an ID token, a signed JWT in which the provider states who the user is (sub), who issued the statement (iss), for which application (aud), and when and how the user authenticated.
• User information: a standardised UserInfo endpoint and standard claims (name, email, picture...) instead of every provider inventing its own "me" API.
• Session establishment: with a verified identity, the application can create its own login session for the user; related specifications cover session management and logout.

Everything is exchanged as JSON, with signed JWTs for the security-relevant statements, which makes OIDC friendly to mobile apps and APIs (unlike the XML-based SAML).

Go deeper:

• OpenID Foundation: How OpenID Connect Works — the official short introduction.
• OpenID Connect Core 1.0: Introduction — the specification's own statement of what OIDC adds to OAuth.
• OpenID (Wikipedia): OpenID Connect — how OIDC relates to the older OpenID 2.0.