What is the Google OpenID Connect Authentication Request?

Before deciding which authentication flow you want to implement in your Web application, you need to have a good understanding of the Google OpenID Connect authentication request, which is the first call you have to make in any authentication flow.

Here is an example of Google OpenID Connect authentication request and its parameters:

GET https://accounts.google.com/o/oauth2/v2/auth? 
client_id=9150833677096-....apps.googleusercontent.com
&redirect_uri=http%3A%2F%2Ffyicenter.com%3aopenID_receiver.php
&response_type=id_token                                    
&scope=openid                                              
&nonce=xxxxxx                                              
&state=yyyyyy

Here are the parameters you need to provide:

• client_id - The Client ID you received from the Google OpenID Connect application registration as presented in the previous tutorial.
• redirect_uri - The URL of a server side script where the authentication response from Google OpenID Connect will be processed. This URL must be defined as a reply URL in Google OpenID Connect application registration settings.
• scope - Must use "openid email" for OpenID Connect protocol. Adding "email" in the scope ensures that user's email is included in the id_token.
• response_type - Can use "id_token", "code", "token", "id_token code" or "id_token token" depending which authentication flow you want to implement.
• nonce - A unique request ID, which will be included in the response from Google OpenID Connect. You can use the "nonce" to validate the response to prevent token replay attacks.
• state - A state identification string, which will be included in the response from Google OpenID Connect. You can use the "state" to the user session on Website.

Google also supports some other request parameters:

• login_hint - Could be the user's email address or the sub string, which is equivalent to the user's Google ID. If you do not provide a login_hint and the user is currently logged in, the consent screen includes a request for approval to release the user’s email address to your app.
• openid.realm - If you are migrating an existing application from OpenID 2.0 to OpenID Connect.
• hd - Optimize the OpenID Connect flow for users of a particular G Suite domain.

Note that if there is issue with authentication request, Google OpenID Connect will display an error page to your end user during the sign-on process.

 

⇒ Initiate Google OpenID Connect Authentication Request

⇐ Google OpenID Connect Metadata Document

⇑ Google OpenID Connect Integration

⇑⇑ OpenID Tutorials