OpenID Connect
also called OIDC
An identity layer over OAuth 2.0 that adds a signed ID token asserting who the user is and how they authenticated.
OAuth 2.0 gives an access token, which is opaque to the client and says nothing verifiable about the user. OIDC adds the ID token: a JWT signed by the identity provider containing the subject, the issuer, the audience, the authentication time and often the method — enough for the application to establish a session.
This is what makes federated single sign-on standard rather than bespoke. It is also the layer that supplies the discovery document and JWKS endpoint that let a service validate tokens without a shared secret.
The validation checklist is short and skipping any of it is a vulnerability: verify the signature against the published keys, check the issuer, check the audience is you, check expiry, and check the nonce against the one you sent.