title: Using openid-connect for authentication spa and rest api
body: <p>I have an API Server (Resource server) and multiple apps, Web GUI (SPA) and a Desktop client and maybe more coming.
  I'd like to use openid-connect besides http basic authentication for my API Server.
  It should be configurable which openid provider to use. My own, facebook, google...
  I only want to do authentication, I do not need their API. I only need some profile data like email or firstname.</p>
  
  <p>Let's say I have configured google as my IdP and I'm currently using my Web GUI (SPA). I need to login, no problem, according to <a href="https://developers.google.com/identity/protocols/OpenIDConnect" rel="noreferrer">https://developers.google.com/identity/protocols/OpenIDConnect</a> I redirect the user to google, get my authorization code and the Web Gui (SPA) gets an id_token and access_token from google.</p>
  
  <p>No problem so far, but now the SPA has to work with my API Server and the API Server needs to authenticate every request (since it is a stateless rest api) coming from the Client (WebGui SPA) and needs to know which user actually did this.</p>
  
  <p><strong>A</strong></p>
  
  <p>So the access_token from google is meant to be used to access google api's right? But I also could just pass this access_token with every request to my api server and the api server calls <a href="https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=xxx" rel="noreferrer">https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=xxx</a> to verify the access_token and get the account name (mail). But this doesn't sound right, does it?</p>
  
  <p><strong>B</strong></p>
  
  <p>I also have and id_token which I can verify without calling google server everytime. So could I also just pass the id_token as bearer with every request to my api server and the api server can verify the id_token? But according to openid-connect spec the access_token is actually the one which just get passed to the api server and the id_token must stay on the client.
  But then the id_token would be completely useless to me, the API server needs to know who the user is, the client (Web GUI) doesn't really care.</p>
  
  <p><strong>C</strong></p>
  
  <p>Or since it is my own API Server, does my API Server actually needs to implement the whole oauth2 system by itself, just not authentication but creating access_token and more. So I would have a /api/tokensign to which I can pass the id_token from google, the API verifies the id_token and creates an access_token for my WebGUI (SPA). And this new access_token can be passed as bearer to every api request. This actually sounds as the best solution according to specs, but do I really need to implement oauth2 by myself into my API? Sounds like a heavy addition since A and B could also be implemented.</p>
  
  <p>My rest-api needs authentication with every request so is A, B, C the right approach? Please don't tell me this is opinion based, it is not.
  What is the right way using oauth2/openid-connect for authentication?</p>