OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that lets a client verify who a user is and receive basic profile information in a standard, verifiable way. Where OAuth 2.0 handles authorization alone, OIDC adds authentication by issuing an ID token.
That ID token is a signed JSON Web Token containing claims about the user, such as a unique subject identifier, when they authenticated, and which authority vouched for them. When you click ‘Sign in with Google’ on a third party site, that site is almost certainly using OIDC: Google authenticates you, returns a signed ID token, and the site trusts it rather than running its own password check. The practical watch-out is validation. An ID token is only trustworthy if the client verifies its signature, issuer, audience, and expiry; skipping those checks turns a security feature into an open door. OIDC is what makes modern single sign-on and social login both convenient and auditable.
Why does OpenID Connect matter for the CISSP exam?
OpenID Connect appears in Domain 5 (Identity and Access Management), which carries 13% of the exam weight. Understand how it extends OAuth 2.0, the purpose of the ID token, and its role in federation. See Domain 5 Identity and Access Management for related material.