OIDC federations use a trust model where entities have unique IDs pointing to signed JSON entity statements describing them. A trust chain is established when two entities trust at least one common trust anchor. Entity statements are fetched and flattened into a single statement to determine authorization details like scopes and response types. Subordinates can specify more restrictive settings than superiors during flattening.

1. OIDC Federations
Roland Hedberg@TechEx18

2. So what about OIDC
federations ?

3. Cornerstones
• Trust Model
• Every entity has a unique
entity ID (URL) that points to
an entity statement descibing
that entity
• Signed JSON Web Token
(JWS)
• Distributed control

4. Entity statement
{
"iss": "https://feide.no",
"sub": "https://ntnu.no",
“iat": 1516239022,
"exp": 1516298022,
"metadata": {
"openid-provider": {
"issuer": "https://ntnu.no",
"organization": "NTNU",
"id_token_signing_alg_values_supported": ["RS256", "RS384", "RS512"]
},
"openid-client": {
"organization": "NTNU",
"grant_types_supported": ["authorization_code", "implicit"],
"scopes": ["openid", "profile", "email", "phone"]
}
},
“jwks": [
{
"alg": "RS256",
"e": "AQAB",
"ext": true,
"key_ops": ["verify"],
"kid": "key1",
"kty": "RSA",
"n": "pnXBOusEANuug6ewezb9J_...",
"use": "sig"
}
],
"authorityHints": ["https://edugain.org/federation"]
}

5. Trust model
• A trust Model is collection of rules that informs
application on how to decide the legitimacy of a set of
statements.
• Trusted 3rd party (hierarchical), thrust anchor.
• 2 entities that wants to communicate MUST trust at least
one trust anchor.
• Trust path = Sequence of signed JWTs

6. Fetching entity statements
Entity_id
authorityHints
authorityHints
FEIDE
NTNU
ENTITY

7. Entity statement tree

8. Trust chain
FEIDE
NTNU
ENTITY
FEIDE
NTNU
ENTITY
ENTITY

9. Flattening
• A subordinate can never overwrite what a superior has
specified.
• A subordinate can specify something more restrictive
then a superior.
ENTITY
NTNU
FEIDE

10. Flattening - example (1)
{
"contacts": [
"helpdesk@example.com"
],
"logo_uri": "https://example.com/logo.jpg",
"policy_uri": "https://example.com/policy.html",
"tos_uri": "https://example.com/tos.html"
}
{
"contacts": [
"helpdesk@example.com"
],
"logo_uri": "https://example.com/logo.jpg",
"policy_uri": "https://example.com/policy.html",
"tos_uri": "https://example.com/tos.html"
"rp_scopes": [
"openid",
"eduperson"
],
"response_types": [
"code",
"code id_token"
]
}
{
"rp_scopes": [
"openid",
"eduperson"
],
"response_types": [
"code",
"code id_token"
]
}
=>
Feide
NTNU
+

11. Flattening - example (1)
{
"contacts": [
"helpdesk@example.com"
],
"logo_uri": "https://example.com/logo.jpg",
"policy_uri": "https://example.com/policy.html",
"tos_uri": "https://example.com/tos.html"
"rp_scopes": [
"openid",
"eduperson"
],
"response_types": [
"code"
],
"redirect_uris": [
"https://example.com/rp1"
]
}
{
"contacts": [
"rp_helpdesk@example.com"
],
"redirect_uris": [
"https://example.com/rp1"
],
"response_types": [
"code"
]
}
=>
{
"contacts": [
"helpdesk@example.com"
],
"logo_uri": "https://example.com/logo.jpg",
"policy_uri": "https://example.com/policy.html",
"tos_uri": "https://example.com/tos.html"
"rp_scopes": [
"openid",
"eduperson"
],
"response_types": [
"code",
"code id_token"
]
}
+
Entity

12. Cornerstones
• Trust Model
• Unique entity ID (URL) that
points to an entity statement
• Signed JSON Web Token
(JWS)
• Distributed control