Using Google OAuth to secure web services in aspnet core

Got it working. As mentioned, I was getting lost, and the OpenIDConnect, though referenced in several areas as a solution, was a red herring for the web services. Here's what is working for me now, with as complete steps as I can provide (some cleanup required):

1. Add authentication to the UI following these directions
2. Obtain the JWT token as shown in the first segment here

3. On each web service call, include the JWT token in the headers:

   Name: Authentication

   Value: Bearer {token value}

4. Install the JwtBearer NuGet package

5. In the ConfigureServices method of Startup in the web service, after you AddMvc():

       services.AddAuthorization(options =>
   {   // this policy needed only if you want to restrict to accounts within your domain. otherwise, don't use options. or use whatever options work for you.
           options.AddPolicy("hd",
               policy => policy.RequireAssertion(context =>
                   context.User.HasClaim(c =>
                       c.Type == "hd" &&
                       ("https://accounts.google.com".Equals(c.Issuer) ||
                        "accounts.google.com".Equals(c.Issuer, StringComparison.CurrentCultureIgnoreCase)) &&
                       c.Value == "yourdomain.com"
                   )));
   });
   

6. In the Configure method, before you UseMvc():

           JwtBearerOptions jwtOptions = new JwtBearerOptions();
           jwtOptions.Audience = "{the OAuth 2.0 client ID credential from google api developer console}";
           jwtOptions.Authority = "https://accounts.google.com";
           jwtOptions.TokenValidationParameters = new TokenValidationParameters();
           jwtOptions.TokenValidationParameters.ValidIssuers = new List<string>()
           {
               "https://accounts.google.com",
               "accounts.google.com"
           };
   
           app.UseJwtBearerAuthentication(jwtOptions);
   

Perhaps there is a more appropriate way to do this...if there is, I'm interested in trying it out. For now, this is working.