title: Using OpenID Connect ID token for application-to-application authentication/authorization
body: <p>(Apologies in advance for possible misuse of the word authentication/authorization)</p>
  
  <p>I am building up several web applications that talks to each other with an identity provider that looks like this.</p>
  
  <pre><code>         A -----&gt; idP
          / \
         /   \
        /     \
      \/_     _\/  
      B         C
  </code></pre>
  
  <p>Where application A will make requests to B and C to push and pull data, and it has to do so in the context of the user that's using application A.  Given that I am using OAuth2 on the idP, my first thought is using the bearer token issued by the identity provider, and pass that around to each application as a way to "login" from application A to B/C.</p>
  
  <p>Problem with that approach is that B/C doesn't know who that bearer token belongs to.  In order to make this work, I would have to create an end point on the idP to get user information that B/C can use to figure out the user.  While this could work, I wanted to see if there was something more standard out there I can use.  That's when I found OpenID Connect.</p>
  
  <p>From what I can see, OpenID Connect basically replaces the bearer token with a JWT, and signs it with a private key to prevent tampering.  Given that, here's the flow I am thinking of:</p>
  
  <ul>
  <li>User authenticates against web application A, application A receives ID token from idP, create a logged in session for the user and store the ID token as part of the session</li>
  <li>Application A needs to retrieve data from application B in the context of user, so it sends the ID token to application B as part of the request</li>
  <li>Application B gets the ID token from the header, gets the public key from the idP, and validates the signature.</li>
  <li>If signature is validated, then the rest of the JWT is validated (expiry, issuer, issued time stamp, audience)</li>
  <li>If all the checks are valid, then the data is returned from B to A</li>
  </ul>
  
  <p>I have a couple of question about using OpenID Connect in this manner:</p>
  
  <ul>
  <li>In OpenID Connect, the JWT's audience field can contain multiple client IDs, but from what I understand, the idP is suppose to only return the client requesting for the token.  So how does the idP know what other client ID to put into the audience field?</li>
  <li>How to best handle logout?  Since each application maintains its own session, my thinking is that logout should invalidate the individual sessions on application A/B/C, then the session on idP to completely logout.  Would that be best handled with an AJAX request to each application?</li>
  </ul>