Flow diagram

OpenID Connect adds an additional token, a signed proof of user authentication, which provides no access rights.
This token is called id token and contains detailed information about the authentication process:
This token can be used to distribute proof of user authentication without giving away access rights. Furthermore, OpenID Connect specifies new request parameters which allow the client to have more control over the authentication process. This includes the possibility to give language preferences, force or suppress user interaction and request authentication on old authenticated sessions.