What is OpenID Connect (OIDC) in ForgeRock AM and how does it differ from OAuth 2.0?

OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 only answers the question "what can this application access?", OIDC additionally answers "who is the logged-in user?" ForgeRock AM acts as an OIDC Provider (OP), issuing ID tokens that carry authenticated user identity claims in addition to OAuth2 access tokens.

The practical differences in ForgeRock AM's context:

• ID Token — OIDC adds a signed JWT (the ID token) to the token response. It contains claims like sub (subject/user ID), iss (issuer), aud (audience/client), iat (issued at), and exp (expiry). OAuth2 access tokens carry no standardised identity claims.
• UserInfo Endpoint — AM exposes /oauth2/userinfo per realm. Clients send the access token and receive a JSON object with the user's profile claims. This is an OIDC standard; plain OAuth2 has no equivalent.
• Discovery Document — OIDC providers publish a /.well-known/openid-configuration endpoint describing all their supported flows, endpoints, and signing algorithms. AM publishes this automatically per realm.
• Scopes — OIDC defines standard scopes: openid (required), profile, email, address, phone. Requesting openid is what triggers OIDC behaviour; without it you get plain OAuth2.

In ForgeRock AM, OIDC is enabled at the OAuth2 provider level within a realm. The same OAuth2 provider configuration serves both OAuth2 and OIDC — OIDC is activated simply by the client requesting the openid scope. AM supports session management extensions (check_session_iframe, end_session_endpoint) for RP-initiated logout.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.