title: (How) does one secure a Web API with OpenID Connect (or not?)
body: <p>Is it recommended or good practice to protect a Web API directly with Open ID Connect or not?
  The setup:</p>
  
  <ul>
  <li>Mobile App</li>
  <li>Authorization Server (ADFS 4.0)</li>
  <li>Web API (ASP.NET Core)</li>
  </ul>
  
  <p>Currently I do the normal OAuth2 "Authorization Code Flow", and then pass the access_code to my Web API in the HTTP Header as "Authorization: Bearer ".
  In ASP.NET core I just do the usual
  services.AddAuthentication(...).AddJwtBearer(...)
  Works fine.</p>
  
  <p>But everyone talks about OAuth2 beeing only "pseudo-authentication" with certain flaws. I want my Users to be a properly authenticated before using my Web API. So it seems like Open ID Connect should be the way to go, aka "real authentication".</p>
  
  <p>But does it actually work to "consume" Open ID Connect authentication in an ASP.NET Core Web API? And if yes, how? And is it good practice? All samples seem to be about Web Sites, not Web APIs.</p>
  
  <p>There is an extension method
  services.AddAuthentication(...).AddOpenIdConnect()</p>
  
  <p>But here <a href="https://stackoverflow.com/questions/50891611/implement-openid-connect-authetication-in-asp-net-web-api">Implement OpenID connect Authetication in asp.net WEB API</a> they state that "this component is designed for user interactive clients".</p>
  
  <p>What i also don't understand, what would I do with the "id_token" I get from Open ID connect.
  Currently i just pass the "access_token" as Bearer.
  How do i consume the id_token?</p>
  
  <p>Some clarifications:</p>
  
  <ul>
  <li>The API does not act on behalf of a user (access to company data).</li>
  <li>The API already has access to the "data". It does not require any auth workflows for itself nor does it need to pass the users credentials along.</li>
  <li>The API needs to know "WHO" the user is, and it has to be done in an modern and good way</li>
  <li>That's why I was thinking of OICD with its "real auth" (VS Oauth2-only which is "pseudo").</li>
  </ul>
  
  <p>I basically cannot wrap my head around how the stuff returned from OICD (id_token) will be passed to my Web API.</p>