OpenID Connect Core 1.0
The protocol source for ID tokens, claims, validation, discovery assumptions, and the distinction between authentication and OAuth authorization.
Keyless CI/CD · Learning path
How does OIDC remove cloud credentials from CI/CD?
A path through OpenID Connect tokens, issuer and audience validation, workflow claims, cloud trust policies, role assumption, and short-lived AWS credentials.
Engineers who need to explain the complete trust exchange and design claim conditions that prevent an untrusted workflow from assuming a deployment role.
- 3
- stages
- 3
- selected readings
- 01
Stage 1
Understand the token and trust boundary
Explain the issuer, subject, audience, signed ID token, discovery metadata, JSON Web Key Set, and relying-party validation steps.
- 02
Stage 2
Map a workflow identity into claims
Explain how a CI platform mints a per-job token and how repository, branch, environment, audience, and subject claims constrain trust.
OpenID Connect in GitHub Actions
Shows the workflow side of the exchange, including token claims, cloud trust conditions, short-lived credentials, and the removal of stored deployment secrets.
- 03
Stage 3
Exchange the token for an AWS role
Explain how AWS registers an OIDC provider, validates token claims, applies the role trust policy, and returns temporary credentials.
Create an OIDC identity provider in IAM
Covers the AWS trust object, issuer metadata, certificate chain, audience configuration, and the relationship between the provider and role trust policy.