User authentication: OpenID Connect

Access tokens are great but OAuth clients aren't allowed to read them. So how do they know who the user is? That's where OpenID Connect comes in. 0:00 Introduction 0:32 id_token 0:51 Identity scopes 1:05 Profile scope 1:23 Authorization request parameters 1:36 id_token structure 2:02 OpenID Connect authentication process 2:54 Code example: client 3:33 Schemes and actions 4:47 ASP.NET Core OpenID Connect handler 5:47 Mapping token to session claims 6:21 User info endpoint 6:53 Calling an API 7:53 Running the demo 10:11 Token management 10:39 Refresh token 11:27 Backchannel response with refresh token 11:33 Refreshing an access token 12:12 Revoking refresh tokens 12:33 Revocation endpoint 12:50 Code example: refresh tokens 13:15 Code example: Duende.AccessTokenManagement.OpenIdConnect 14:10 Conclusion #identityserver #aspnetcore #oauth2 #openidconnect #csharp #security