OpenID Connect รู้จัก OIDC ฉบับครบถ้วน 2026

OpenID Connect คืออะไร

OpenID Connect (OIDC) เป็น identity layer ที่สร้างอยู่บน OAuth 2.0 protocol ให้ applications ตรวจสอบตัวตนผู้ใช้ (authentication) และดึงข้อมูลพื้นฐานของผู้ใช้ (profile information) ได้ พัฒนาโดย OpenID Foundation เผยแพร่ครั้งแรกในปี 2014

ความแตกต่างระหว่าง OAuth 2.0 กับ OpenID Connect คือ OAuth 2.0 เป็น authorization protocol อนุญาตให้ app เข้าถึง resources ของผู้ใช้ (เช่น อ่าน Google Drive) แต่ไม่ได้บอกว่าผู้ใช้เป็นใคร OIDC เพิ่ม authentication layer บน OAuth 2.0 ทำให้รู้ว่าผู้ใช้เป็นใคร ผ่าน ID Token (JWT) ที่มีข้อมูลเช่น sub (user ID), email, name

Components หลักของ OIDC ได้แก่ OpenID Provider (OP) เช่น Google, Azure AD, Keycloak ทำหน้าที่ authenticate ผู้ใช้และออก tokens, Relying Party (RP) คือ application ที่ต้องการ authenticate ผู้ใช้, ID Token เป็น JWT ที่มีข้อมูลผู้ใช้, Access Token ใช้เข้าถึง protected resources, UserInfo Endpoint ให้ข้อมูลเพิ่มเติมของผู้ใช้

ติดตั้ง OpenID Connect Provider

Setup Keycloak เป็น OIDC Provider

# === OpenID Connect Provider Setup ===

# 1. Install Keycloak with Docker
cat > docker-compose.yml << 'EOF'
version: '3.8'
services:
  keycloak:
    image: quay.io/keycloak/keycloak:24.0
    command: start-dev
    ports:
      - "8080:8080"
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak_pass
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin_pass
    depends_on:
      - postgres

  postgres:
    image: postgres:16
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak_pass
    volumes:
      - pg_data:/var/lib/postgresql/data

volumes:
  pg_data:
EOF

docker-compose up -d

# 2. Access Keycloak Admin Console
# URL: http://localhost:8080/admin
# Login: admin / admin_pass

# 3. Create Realm
# Keycloak Admin > Create Realm
# Realm Name: myapp
# Enabled: ON

# 4. Create Client (OIDC Application)
# Clients > Create Client
# Client ID: my-web-app
# Client Protocol: openid-connect
# Root URL: http://localhost:3000
# Valid Redirect URIs: http://localhost:3000/callback
# Web Origins: http://localhost:3000

# 5. OIDC Discovery Endpoint
curl -s http://localhost:8080/realms/myapp/.well-known/openid-configuration | python3 -m json.tool

# Output includes:
# - authorization_endpoint
# - token_endpoint
# - userinfo_endpoint
# - jwks_uri
# - supported scopes
# - supported response_types
# - supported grant_types

# 6. Create Test User
# Users > Add User
# Username: testuser
# Email: test@example.com
# First Name: Test
# Last Name: User
# Email Verified: ON
# Credentials > Set Password: test123
# Temporary: OFF

# 7. Test Authentication Flow
# Authorization URL:
# http://localhost:8080/realms/myapp/protocol/openid-connect/auth?
#   client_id=my-web-app&
#   response_type=code&
#   scope=openid profile email&
#   redirect_uri=http://localhost:3000/callback&
#   state=random_state_value

echo "Keycloak OIDC Provider configured"

Authentication Flows

OIDC Authentication Flows ที่สำคัญ

# === OIDC Authentication Flows ===

# 1. Authorization Code Flow (Recommended for web apps)
# ===================================
# Step 1: Redirect user to authorization endpoint
# GET /authorize?
#   response_type=code&
#   client_id=my-web-app&
#   redirect_uri=http://localhost:3000/callback&
#   scope=openid profile email&
#   state=xyz123&
#   nonce=abc456

# Step 2: User authenticates at OP (login page)
# Step 3: OP redirects back with authorization code
# GET http://localhost:3000/callback?code=AUTH_CODE&state=xyz123

# Step 4: Exchange code for tokens (server-side)
curl -X POST http://localhost:8080/realms/myapp/protocol/openid-connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "client_id=my-web-app" \
  -d "client_secret=CLIENT_SECRET" \
  -d "redirect_uri=http://localhost:3000/callback"

# Response:
# {
#   "access_token": "eyJhbGciOiJSUzI1NiI...",
#   "token_type": "Bearer",
#   "expires_in": 300,
#   "refresh_token": "eyJhbGciOiJIUzI1NiI...",
#   "id_token": "eyJhbGciOiJSUzI1NiI..."
# }

# Step 5: Decode ID Token (JWT)
# Header: {"alg": "RS256", "typ": "JWT", "kid": "key-id"}
# Payload: {
#   "iss": "http://localhost:8080/realms/myapp",
#   "sub": "user-uuid",
#   "aud": "my-web-app",
#   "exp": 1705305900,
#   "iat": 1705305600,
#   "nonce": "abc456",
#   "email": "test@example.com",
#   "name": "Test User",
#   "preferred_username": "testuser"
# }

# 2. Authorization Code Flow with PKCE (SPA / Mobile)
# ===================================
# Generate code_verifier (random 43-128 chars)
# code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
# code_challenge = BASE64URL(SHA256(code_verifier))

# Step 1: Include code_challenge in auth request
# GET /authorize?
#   response_type=code&
#   client_id=my-spa&
#   code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&
#   code_challenge_method=S256&
#   ...

# Step 4: Include code_verifier in token request
# POST /token
#   grant_type=authorization_code&
#   code=AUTH_CODE&
#   code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

# 3. Get UserInfo
curl -H "Authorization: Bearer ACCESS_TOKEN" \
  http://localhost:8080/realms/myapp/protocol/openid-connect/userinfo

echo "OIDC flows documented"

Implement OIDC ใน Application

Integrate OIDC กับ web application

#!/usr/bin/env python3
# oidc_client.py — OIDC Client Implementation
import json
import hashlib
import base64
import secrets
import logging
from typing import Dict, Optional
from urllib.parse import urlencode

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("oidc")

class OIDCClient:
    def __init__(self, issuer, client_id, client_secret=None, redirect_uri=""):
        self.issuer = issuer
        self.client_id = client_id
        self.client_secret = client_secret
        self.redirect_uri = redirect_uri
        self.discovery = None
    
    def discover(self):
        """Fetch OIDC discovery document"""
        # In production: requests.get(f"{self.issuer}/.well-known/openid-configuration").json()
        self.discovery = {
            "issuer": self.issuer,
            "authorization_endpoint": f"{self.issuer}/protocol/openid-connect/auth",
            "token_endpoint": f"{self.issuer}/protocol/openid-connect/token",
            "userinfo_endpoint": f"{self.issuer}/protocol/openid-connect/userinfo",
            "jwks_uri": f"{self.issuer}/protocol/openid-connect/certs",
            "end_session_endpoint": f"{self.issuer}/protocol/openid-connect/logout",
            "scopes_supported": ["openid", "profile", "email", "roles"],
            "response_types_supported": ["code", "id_token", "code id_token"],
            "grant_types_supported": ["authorization_code", "refresh_token"],
        }
        return self.discovery
    
    def generate_pkce(self):
        """Generate PKCE code verifier and challenge"""
        verifier = secrets.token_urlsafe(32)
        challenge = base64.urlsafe_b64encode(
            hashlib.sha256(verifier.encode()).digest()
        ).rstrip(b"=").decode()
        
        return {"code_verifier": verifier, "code_challenge": challenge}
    
    def build_auth_url(self, scope="openid profile email", pkce=None):
        """Build authorization URL"""
        state = secrets.token_urlsafe(16)
        nonce = secrets.token_urlsafe(16)
        
        params = {
            "response_type": "code",
            "client_id": self.client_id,
            "redirect_uri": self.redirect_uri,
            "scope": scope,
            "state": state,
            "nonce": nonce,
        }
        
        if pkce:
            params["code_challenge"] = pkce["code_challenge"]
            params["code_challenge_method"] = "S256"
        
        auth_endpoint = self.discovery["authorization_endpoint"]
        url = f"{auth_endpoint}?{urlencode(params)}"
        
        return {
            "url": url,
            "state": state,
            "nonce": nonce,
        }
    
    def exchange_code(self, code, code_verifier=None):
        """Exchange authorization code for tokens"""
        token_request = {
            "grant_type": "authorization_code",
            "code": code,
            "client_id": self.client_id,
            "redirect_uri": self.redirect_uri,
        }
        
        if self.client_secret:
            token_request["client_secret"] = self.client_secret
        if code_verifier:
            token_request["code_verifier"] = code_verifier
        
        # In production: requests.post(discovery["token_endpoint"], data=token_request)
        return {
            "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
            "token_type": "Bearer",
            "expires_in": 300,
            "refresh_token": "eyJhbGciOiJIUzI1NiJ9...",
            "id_token": "eyJhbGciOiJSUzI1NiJ9...",
        }
    
    def validate_id_token(self, id_token, nonce):
        """Validate ID token claims"""
        # In production: decode JWT, verify signature with JWKS
        claims = {
            "iss": self.issuer,
            "sub": "user-uuid-123",
            "aud": self.client_id,
            "exp": 1705305900,
            "iat": 1705305600,
            "nonce": nonce,
            "email": "test@example.com",
            "name": "Test User",
        }
        
        validations = {
            "issuer_match": claims["iss"] == self.issuer,
            "audience_match": claims["aud"] == self.client_id,
            "nonce_match": claims["nonce"] == nonce,
            "not_expired": True,  # check exp > now
            "signature_valid": True,  # verify with JWKS
        }
        
        return {
            "valid": all(validations.values()),
            "claims": claims,
            "validations": validations,
        }

client = OIDCClient(
    issuer="http://localhost:8080/realms/myapp",
    client_id="my-web-app",
    client_secret="secret123",
    redirect_uri="http://localhost:3000/callback"
)

discovery = client.discover()
print("Discovery:", json.dumps(list(discovery.keys()), indent=2))

pkce = client.generate_pkce()
auth = client.build_auth_url(pkce=pkce)
print("\nAuth URL:", auth["url"][:100] + "...")

validation = client.validate_id_token("token...", auth["nonce"])
print("\nValidation:", json.dumps(validation["validations"], indent=2))

Security Best Practices

แนวทาง security สำหรับ OIDC

# === OIDC Security Best Practices ===

# 1. Always Use PKCE
# ===================================
# Even for confidential clients (server-side)
# PKCE prevents authorization code interception attacks
# Use S256 method (not plain)
# code_challenge = BASE64URL(SHA256(code_verifier))

# 2. Validate ID Token Properly
# ===================================
# Checklist:
# [ ] Verify JWT signature using JWKS from provider
# [ ] Check iss (issuer) matches expected value
# [ ] Check aud (audience) contains your client_id
# [ ] Check exp (expiration) is in the future
# [ ] Check iat (issued at) is not too far in the past
# [ ] Check nonce matches the one sent in auth request
# [ ] Check azp (authorized party) if present
#
# NEVER trust ID token without full validation
# NEVER decode JWT without verifying signature

# 3. Token Storage
# ===================================
# Server-side (recommended):
#   - Store tokens in server session
#   - Use HTTP-only, Secure, SameSite cookies for session ID
#   - Never expose tokens to client-side JavaScript
#
# SPA (if needed):
#   - Use in-memory storage (not localStorage/sessionStorage)
#   - Use BFF (Backend for Frontend) pattern
#   - Short-lived access tokens (5-15 minutes)
#   - Silent refresh with refresh tokens

# 4. State Parameter
# ===================================
# MUST use state parameter to prevent CSRF
# Generate cryptographically random state
# Store in session, verify on callback
# state = secrets.token_urlsafe(32)

# 5. Redirect URI Validation
# ===================================
# Register exact redirect URIs (no wildcards)
# Use HTTPS in production
# Validate redirect_uri on both authorization and token requests
# Never allow open redirects

# 6. Token Lifetime Configuration
# ===================================
# Keycloak settings:
# Realm Settings > Tokens
# Access Token Lifespan: 5 minutes
# Refresh Token Lifespan: 30 minutes
# ID Token Lifespan: 5 minutes
# SSO Session Idle: 30 minutes
# SSO Session Max: 8 hours

# 7. Logout
# ===================================
# Implement both:
# - Local logout (clear session)
# - RP-Initiated Logout (redirect to OP logout endpoint)
# POST /protocol/openid-connect/logout
#   id_token_hint=ID_TOKEN&
#   post_logout_redirect_uri=http://localhost:3000&
#   state=logout_state

# 8. Scope Minimization
# ===================================
# Request only needed scopes
# openid (required)
# profile (name, picture)
# email (email address)
# Don't request: offline_access unless needed

echo "Security best practices documented"

Troubleshooting และ Monitoring

Debug และ monitor OIDC

#!/usr/bin/env python3
# oidc_monitor.py — OIDC Monitoring
import json
import logging
from datetime import datetime
from typing import Dict

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("monitor")

class OIDCMonitor:
    def __init__(self):
        self.events = []
    
    def track_auth_event(self, event_type, details):
        event = {
            "timestamp": datetime.utcnow().isoformat(),
            "type": event_type,
            "details": details,
        }
        self.events.append(event)
        return event
    
    def common_errors(self):
        return {
            "invalid_client": {
                "cause": "Wrong client_id or client_secret",
                "fix": "Check Keycloak client configuration, verify credentials",
            },
            "invalid_grant": {
                "cause": "Authorization code expired or already used",
                "fix": "Code expires in 60 seconds, ensure single use, check clock sync",
            },
            "invalid_redirect_uri": {
                "cause": "redirect_uri doesn't match registered URIs",
                "fix": "Add exact URI in Keycloak client > Valid Redirect URIs",
            },
            "invalid_scope": {
                "cause": "Requested scope not allowed for client",
                "fix": "Enable scope in Keycloak client > Client Scopes",
            },
            "token_expired": {
                "cause": "Access token or refresh token expired",
                "fix": "Implement token refresh flow, adjust token lifetimes",
            },
            "signature_verification_failed": {
                "cause": "JWT signature doesn't match JWKS",
                "fix": "Fetch latest JWKS, check key rotation, verify algorithm",
            },
        }
    
    def health_check(self):
        checks = {
            "discovery_endpoint": {"status": "ok", "latency_ms": 15},
            "token_endpoint": {"status": "ok", "latency_ms": 45},
            "userinfo_endpoint": {"status": "ok", "latency_ms": 25},
            "jwks_endpoint": {"status": "ok", "latency_ms": 10},
            "certificate_expiry_days": 365,
        }
        
        all_ok = all(c.get("status") == "ok" for c in checks.values() if isinstance(c, dict))
        
        return {
            "healthy": all_ok,
            "checks": checks,
            "timestamp": datetime.utcnow().isoformat(),
        }

monitor = OIDCMonitor()
errors = monitor.common_errors()
print("Common Errors:", json.dumps(list(errors.keys()), indent=2))

health = monitor.health_check()
print("Health:", json.dumps(health, indent=2))

FAQ คำถามที่พบบ่อย

Q: OpenID Connect กับ SAML ต่างกันอย่างไร?

A: OIDC ใช้ JSON/JWT format เบากว่า ง่ายกว่า เหมาะสำหรับ modern web apps, SPAs, mobile apps ทำงานบน OAuth 2.0 SAML ใช้ XML format หนักกว่า ซับซ้อนกว่า เหมาะสำหรับ enterprise SSO legacy applications OIDC มี discovery endpoint ทำให้ configuration อัตโนมัติ SAML ต้อง exchange metadata manually สำหรับ applications ใหม่แนะนำ OIDC เสมอ SAML สำหรับ legacy enterprise integrations ที่ไม่รองรับ OIDC

Q: OIDC Provider ที่แนะนำมีอะไรบ้าง?

A: Self-hosted Keycloak เป็น open source ที่ popular ที่สุด มี features ครบ SSO, MFA, social login, user federation รองรับ OIDC, SAML, OAuth 2.0 Cloud-based Auth0 (Okta) ง่ายที่สุด มี free tier 7,500 active users, Azure AD (Entra ID) สำหรับ Microsoft ecosystem, Google Identity Platform สำหรับ Google Cloud, AWS Cognito สำหรับ AWS ecosystem สำหรับ startup เริ่มจาก Auth0 free tier สำหรับ enterprise ใช้ Keycloak (self-host) หรือ Azure AD

Q: Authorization Code Flow กับ Implicit Flow ใช้อันไหน?

A: ใช้ Authorization Code Flow เสมอ Implicit Flow ถูก deprecate แล้วใน OAuth 2.1 เพราะ tokens ถูก expose ใน URL fragment (browser history, logs) สำหรับ SPA ใช้ Authorization Code Flow with PKCE ที่ปลอดภัยกว่า code แลกเป็น token ผ่าน backchannel ไม่ expose ใน URL สำหรับ server-side apps ใช้ Authorization Code Flow with client secret + PKCE

Q: Token refresh ทำอย่างไร?

A: เมื่อ access token หมดอายุ (ดูจาก exp claim หรือ expires_in) ใช้ refresh token ขอ access token ใหม่ POST /token กับ grant_type=refresh_token และ refresh_token=xxx ได้ access token ใหม่และ refresh token ใหม่ (rotation) สำหรับ SPA ใช้ silent refresh ผ่าน hidden iframe หรือ service worker ตั้ง timer ก่อน token หมดอายุ 30 วินาทีเพื่อ refresh ล่วงหน้า ถ้า refresh token หมดอายุต้อง redirect user กลับไป login ใหม่