<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">First, I’d like to appologize for not being active on this list (yet). I have some opinions when it comes to the design of OpenID Connect Federations.</div>
<div class=""><br class="">
</div>
<div class="">I think it is crucial that we build a flexible trust infrastructure that can handle more generic federations of entities sharing data, and not just supporting end-user authentication. Federations for end-user authentication were already solved
10 years ago, and now the use cases that needs to be solved are far more complex.</div>
<div class=""><br class="">
</div>
I’ve tried to draft such a specification for trust between entities, and how OpenID Connection would work on top of that.
<div class=""><br class="">
</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span><a href="https://oauth.no/jwtfederations/" class="">https://oauth.no/jwtfederations/</a> </div>
<div class=""><br class="">
</div>
<div class="">I’d really appreciate feedback on this work. Note that this spec deviates from the current OpenID Connect Federation specification that is up for vote.</div>
<div class=""><br class="">
</div>
<div class="">Here are some of the major differences:</div>
<div class="">* it does not rely on client registrations - because that does not scale</div>
<div class="">* it does rely on asymetric keys - becauce that scales</div>
<div class="">* it makes use of webfinger for trust and metadata discovery in both directions - discoverying the client the same way that you discover a provider</div>
<div class="">* it does not rely on embedded JWTs, instead independent JWTs that is fetched from the entity it self. Embedding JWTs comes at a cost of added complexity, and does not really give any thing back.</div>
<div class="">* it enforces a stable client_id for all clients, which is also enforced to be globally unique, and is reused across federations. This has several benefits.</div>
<div class="">* it is rather easy to append the federation layer on top of a standard OIDC client / provider implementation. The webfinger resolve component can be deployed independent from the rest, and the other part can be added as a middleware to the metadata
store plugin of existing implementations.</div>
<div class="">* it does not involve the challenging state management of temporary secrets for each provider that times out and needs to invoke a new registration process each time.</div>
<div class="">* it does not involve the complexity of performing an updated client registration each time you change configuration/metadata on the client</div>
<div class="">* it is not limited to OpenID Connect, but can also be used for OAuth federations and other federations of entities sharing userdata orthogonal but interacting with the federation of end-user authentication. </div>
<div class="">
<div class=""><br class="webkit-block-placeholder">
</div>
<div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="Apple-interchange-newline">
Andreas Åkre Solberg</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
Senior Technical Architect</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
UNINETT – <a href="https://uninett.no" class="">https://uninett.no</a> </div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
<a href="https://www.linkedin.com/in/andreassolberg/" class="">https://www.linkedin.com/in/andreassolberg/</a></div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<br class="">
</div>
<br class="Apple-interchange-newline" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</body>
</html>