## Ch. 2

## Ch. 3 OpenId Connect Endpoints
##### 3.1 Authorization Endpoint
- displays authentication and consent screen
- returns `authorization_code` See ch. 5
- client initiates the call to the authorization endpoint
###### 3.1.2 input parameters with examples
```
scope: openid profile email address phone
response_type: code (backend flow) || id_token token (frontend flow) || code id_token (hybrid)
client_id: id of the client
redirect_uri: redirect url
state: cross-site scripting protection
nonce: required for implict flow (frontend flow)
Optional Params: (more research on each)
claims:
display:
prompt:
max_age: maximum lifetime of the token in seconds after which the user must re-authenticate
ui_locales: 
id_token_hint:
login_hint:
acr_values:
```

###### 3.1.3 Output
Sends authentication and access delegation (authorization) tokens to redirect endpoint. Token/s are sent as an HTTP 302 redirect.

##### Ch 3.2 Resource Endpoint
Managed by the resource provider. Serves protected resources to authorized parties.  valid OAuth `access_token` required

##### Ch 3.3 Userinfo Endpoint
This is a resource endpoint `/userinfo` that serves profile information of the authenticated end-user.
This endpoint returns a list of claims like DOB, name, email, phone_number, profile_picture or any other claim.
This is Defined in the OpenID Connect Standard.
To the OAuth server, it's just a resource endpoint. 
1) Will typically be a GET request but should support POST (not sure why)
2) should support CORS
3) Should return JSON `Content-Type: application/json` Might need to be a JWT `Content-Type: application/jwt`
```
List of Claims:
sub: something to id the user
name
family_name
preferred_username
picture
email
birthday
zoneinfo: time zone
updated_at: last updated to the profile
Other Claims:
nonce
auth_time
at_hash: access_token hash
c_hash: authorization_code hash
acr: more research
amr: more research
sub_jwk: public key to check the signature of the id_token
```

##### 3.4 Token Endpoint
Called by the Client.
Client sends client_id, client_secret, and authorization_code to get an access_token, refresh_token, or id_token

```
Client->/token
HTTP header
Content-Type: application/x-www-form-urlencoded
Authorization: Basic {Base64URL-encoding(clientID:clientSecret)}

Form Parameters:
grant_type: authorization_code
code: the authorization_code proved by the authorization endpoint
redirect_ur: redirect URL

Response:
Header:
Cache-Control: no-store
Pragma: no-cache
Body:
{
	expires_in: access_token expiration in seconds,
	access_token: OAuth access_token,
	token_type: access token type `Bearer`,
	refresh_token: OAuth refresh_token,
	id_token: id_token for the end user
}
```
###### 3.4.4 Validations at the Token Endpoint
- Authenticate the client
- validate authorization_code
	- was issued to client
	- is valid
	- hasn't been used
- validate redirect_uri matches pre-registered value
##### 3.5 Redirect Endpoint
authorization endpoint delivers `id_token, access_token, authorization_token`

## Ch. 4 Tokens in OpenID Connect

```
id_token
access_token
refresh_token
authorization_code
```

##### Two types of tokens:

**Reference Tokens 
- Randomly Generated String
- Opaque
 
 **Value Token
 - Contain things like claims ie JWT
##### 4.2 Access Token
- typically reference tokens
- holder has access rights to Resource Provider
- short lived token
- bearer token
- id_token typically bound to the access token what the `at_hash` claim

##### 4.3 Refresh Token
- long lived token
- used to request new id_token and access_token
- not available with implicit flow
##### 4.4 Authorization Code
- very short lived token
- only give after authentication and consent
- only used to request an `access_token` (I think the book means refresh_token but access_token and id_tokens can be sent too)
##### 4.5 ID Token
- Contains claims 
- is a value token
- is a JWT, JWE, or JWS
## Ch. 5 OpenID Connect Flows

## ChatGPT flow:
https://chatgpt.com/c/677a04ed-58cc-8009-b191-be8164bc4946