OpenID Connect fixes this exact problem. It fills in the gaps of OAuth2, where it often left the details up to the implementor, there is now a well defined proc

OpenID Connect fixes this exact problem. It fills in the gaps of OAuth2, where it often left the details up to the implementor, there is now a well defined process for verifying identity, and it's all done using IETF standards.