Building federations with OpenID Connect using a trusted third party and dynamic exchange of metadata.

1. OpenID Connect Federation
Workshop
UNINETT 6. oktober 2017
andreas.solberg@uninett.no
Andreas Åkre Solberg

2. 2
SAML 2.0
SP
SAML 2.0
SP
SAML 2.0
SP
SAML 2.0
IdP
SAML 2.0
IdP
SAML 2.0
IdP
SAML 2.0
Metadata
Aggregate

3. 3
SAML 2.0
SP
SAML 2.0
SP
SAML 2.0
SP
SAML 2.0
IdP
SAML 2.0
IdP
SAML 2.0
IdP
SAML 2.0
Metadata
Aggregate
SAML 2.0
Metadata
Aggregate
SAML 2.0
Metadata
Aggregate
eduGAIN

4. 4
OIDC
Client
OIDC
Client
OIDC
Client
OIDC
Provider
Self-service
Registry

5. 5
OIDC
Client
OIDC
Provider
Discovery
Registration
Authentication request
Token request
Provider
metadata
client
config

6. Metadata
Express something about:
Client (an unregistered one)
Provider
Schema similar to:
OpenID Connect Discovery Response describes a
provider
OpenID Connect Dynamic Client registration
request describes a client
Using JWS to sign and chain trust to a common root
6

7. Signed metadata
7

8. Rolands
OpenID Connect Federations
8
Nested metadata

9. Rolands
OpenID Connect Federations
9
OIDC
Client
OIDC
Provider
Discovery
Registration
Authentication request
Token request
Signed
Provider
metadatasigned client
metadata
client
config
client_secret

10. Less state in clients
Complex to deal with expired
Possibility to use vanilla OIDC Core clients.
Use of asymmetric crypto
10
Proposed changes

11. 11

12. 12

13. 13

14. 14

15. 15

16. 16

17. 17

18. 18

19. 19

20. OpenID Client requirements
100% vanilla OpenID Connect Core Client should interop with
OIDC Fed Provider.
Restrictions on what part of [Core] to use. Typically client
authentication using private_key_jwt
The client may want to filter / configure which OP to trust. This can
typically be added as a hook in the Discovery process.
Will need to host a well-known static document at client hostname,
pointing to a registry or other that issues a signed metadata
statement about the client.
20

21. OpenID Provider requirements
Single hook where to validate and discover OIDC client metadata.
Typically implement the client configuration store
getClientConfig(String client_id)
getClientConfig(‘https://client.example.org’)
Will need to publish a signed Metadata Statement along with
Provider config at well known location.
21

22. Nested MS versus flat list of signed MS.
Pros cons?
22