Introduction to OpenID Connect
April 16, 2024
Michael B. Jones
Self-Issued Consulting

Working Together

OpenID Connect

What is OpenID Connect?
• Simple identity layer on top of OAuth 2.0• Enables Relying Parties (RPs) to verify identity of end-user• Enables RPs to obtain basic profile info
• REST/JSON interfaces → low barrier to entry• Described at https://openid.net/connect/

You’re Almost Certainly Using OpenID Connect!
• Android, AOL, Apple, AT&T, Auth0, Deutsche Telekom,
ForgeRock, Google, GrabTaxi, GSMA Mobile Connect, IBM,
KDDI, Microsoft, NEC, NRI, NTT, Okta, Oracle, Orange, Ping
Identity, Red Hat, Salesforce, Softbank, Symantec, Telefónica,
Verizon, Yahoo, Yahoo! Japan, all use OpenID Connect– Many other sites and apps large and small use OpenID Connect• OpenID Connect is infrastructure– Not a consumer brandOpenID Connect Range• Spans use cases, scenarios– Internet, Enterprise, Mobile, Cloud, Federated, User-Centric• Spans security & privacy requirements– From non-sensitive information to highly secure• Spans sophistication of claims usage– From basic default claims to specific requested claims to collecting claims
in multiple formats from multiple sources• Maximizes simplicity of implementations– Uses existing IETF specs: OAuth 2.0, JSON Web Token (JWT), etc.
– Lets you build only the pieces you need

Numerous Awards• OpenID Connect won 2012 European Identity
Award for Best Innovation/New Standard– https://openid.net/2012/04/18/openid-connectwins-2012-european-identity-and-cloud-award/• OAuth 2.0 won in 2013
• JSON Web Token (JWT) & JOSE won in 2014
• OpenID Certification program won
2018 Identity Innovation Award• OpenID Certification program won
2018 European Identity Award

Presentation Overview• Introduction• Design Philosophy• Timeline• A Look Under the Covers• Overview of OpenID Connect Specs• More OpenID Connect Specs• OpenID Certification• Resources

Design Philosophy

Keep Simple
Things Simple
Make Complex
Things Possible

Keep Simple Things Simple

UserInfo Endpoint for
simple claims about user
Designed to work well on
mobile phones

How We Made It Simple• Built on OAuth 2.0• Uses JavaScript Object Notation (JSON)• Lets you build only the pieces that you need
• Goal: Easy implementation on all modern development
platforms

Make Complex Things Possible

Encrypted Claims
Aggregated Claims
Distributed Claims

Key Differences from OpenID 2.0• Support for native client applications• Identifiers using e-mail address format• UserInfo Endpoint for simple claims about user
• Designed to work well on mobile phones• Uses JSON/REST, rather than XML• Support for encryption and higher LOAs
• Support for distributed and aggregated claims• Support for session management, including logout• Support for self-issued identity providers

OpenID Connect Timeline• Artifact Binding working group formed, March 2010
• Major design issues closed at IIW, May 2011
– Result branded “OpenID Connect”• 5 rounds of interop testing between 2011 and 2013
– Specifications refined after each round of interop testing• Won Best New Standard award at EIC, April 2012
• Final specifications approved, February 2014
• Errata Set 1 approved, November 2014
• OpenID Connect Certification launched, April 2015
• OpenID Federation work begun, July 2016
• OpenID Certification program won awards in March 2018 and April 2018
• Logout specifications became Final, September 2022
• Numerous extension specs under way, including for Verifiable Credentials, 2019-present• Errata Set 2 approved, December 2023
• OpenID Connect submitted to ISO for publication as PAS specifications, January 2024

A Look Under the Covers• ID Token• Claims Requests• UserInfo Claims• Example Protocol Messages

ID Token• JSON Web Token (JWT) representing logged-in session• Claims:– iss – Issuer– sub – Identifier for subject (user)– aud – Audience for ID Token– iat – Time token was issued– exp – Expiration time
– nonce – Mitigates replay attacks

ID Token Claims Example{"iss": "https://server.example.com","sub": "248289761001","aud": "0acf77d4-b486-4c99-bd76-074ed6a64ddf","iat": 1311280970,"exp": 1311281970,"nonce": "n-0S6_WzA2Mj"}

Claims Requests• Basic requests made using OAuth scopes:– openid – Declares request is for OpenID Connect– profile – Requests default profile info

– email – Requests email address & verification status– address – Requests postal address– phone – Requests phone number & verification status– offline_access – Requests Refresh Token issuance• Requests for individual claims can be made using JSON
“claims” request parameter

UserInfo Claims• sub• name• given_name• family_name• middle_name• nickname• preferred_username• profile• picture• website

•
•
•
•
•
•
•
•
•
•

genderbirthdate
localezoneinfo
updated_at
email
email_verified
phone_number
phone_number_verified
address

UserInfo Response Example{"sub": "248289761001","name": "Jane Doe","given_name": "Jane","family_name": "Doe","email": "janedoe@example.com","email_verified": true,"picture": "https://example.com/janedoe/me.jpg"}

Authorization Request Example
https://server.example.com/authorize?response_type=id_token%20token&client_id=0acf77d4-b486-4c99-bd76-074ed6a64ddf&redirect_uri=https%3A%2F%2Fclient.example.com%2Fcb&scope=openid%20profile&state=af0ifjsldkj&nonce=n-0S6_WzA2Mj

Authorization Response Example
HTTP/1.1 302 Found
Location: https://client.example.com/cb#access_token=mF_9.B5f-4.1JqM&token_type=bearer&id_token=eyJhbGzI1NiJ9.eyJz9Glnw9J.F9-V4IvQ0Z&expires_in=3600&state=af0ifjsldkj

UserInfo Request Example
GET /userinfo HTTP/1.1
Host: server.example.com
Authorization: Bearer mF_9.B5f-4.1JqMOriginal Overview of Specifications

OpenID 2.0 to OpenID Connect Migration(Additional Final Specification)• Defines how to migrate from OpenID 2.0 to OpenID Connect– Has OpenID Connect identity provider also return OpenID 2.0
identifier, enabling account migration• https://openid.net/specs/openid-connect-migration-1_0.html• Completed April 2015
• Google shut down OpenID 2.0 support in April 2015
• AOL, Yahoo, others have replaced OpenID 2.0 with OpenID
ConnectOAuth 2.0 Form Post Response Mode
(Additional Final Specification)• Defines how to return OAuth 2.0 Authorization Response
parameters (including OpenID Connect Authentication Response
parameters) using HTML form values auto-submitted by the User
Agent using HTTP POST
• A “form post” binding, like SAML and WS-Federation– An alternative to fragment encoding• https://openid.net/specs/oauth-v2-form-post-response-mode1_0.html• Completed April 2015
• In production use by Microsoft, Ping Identity

RP-Initiated Logout• Enables RP to request that OP log out end-user– https://openid.net/specs/openid-connect-rpinitiated-1_0.html– Content recently split out of Session Management spec

• Can be used with all OP-Initiated Logout methods• Not affected by browser privacy changes– (unlike some of the OP-Initiated Logout methods)• Final Specification as of September 2022

OP-Initiated Logout• Enables OP to request that RPs log out end-user’s sessions with the OP• Three approaches specified by the working group:– Session Management• https://openid.net/specs/openid-connect-session-1_0.html• Uses HTML5 postMessage to communicate state changes between OP and RP iframes– Front-Channel Logout• https://openid.net/specs/openid-connect-frontchannel-1_0.html• Uses HTTP GET to load image or iframe, triggering logout (similar to SAML, WS-Federation)– Back-Channel Logout• https://openid.net/specs/openid-connect-backchannel-1_0.html• Server-to-communication not using the browser (so can be used by native applications)• All support multiple logged-in sessions from OP at RP• Session Management & Front-Channel Logout affected by browser privacy changes• Final Specifications as of September 2022

unmet_authentication_requirements

Specification• OpenID Connect Core Error Code unmet_authentication_requirements– https://openid.net/specs/openid-connect-unmet-authentication-requirements-1_0.html• Defines unmet_authentication_requirements error code
• Enables OP to signal that it failed to authenticate the End-User per the
RP’s requirements• Became Final in November 2022

prompt=create Specification• Initiating User Registration via OpenID Connect specification– https://openid.net/specs/openid-connect-prompt-create-1_0.html• Requests enabling account creation during authentication• Became Final in December 2022

Tenth Anniversary of OpenID Connect▪ OpenID Connect specifications were approved in February 2014
▪ Three celebrations are being held
▪ January 2024 at Japan OpenID Summit in Tokyo▪ May 2024 at Identiverse in Las Vegas▪ June 2024 at EIC in Berlin▪ Presentations from first celebration published at https://self-issued.info/?p=2481▪ During the celebrations, we are sharing our perspectives on▪ How we developed OpenID Connect▪ Why it succeeded▪ Lessons we learned along the way▪ Lessons learned▪ “Keep simple things simple”▪ Repeated interop testing and incorporating resulting feedback from developers was critical▪ Certification enables an ecosystem of interoperable implementations

Exciting time for OpenID Connect!
• More happening than at any time since original specs created• I’ll give you a taste of the exciting work happening…

OpenID Federation Specification• OpenID Federation specification– https://openid.net/specs/openid-federation-1_0.html• Enables trust establishment and maintenance of multi-party federations– Applying lessons learned from large-scale SAML federations– Can be used for OpenID Connect, OAuth 2.0 deployments• Recently renamed from “OpenID Connect Federation” to reflect broader role
– Can be and is used both with and without OpenID Connect• Defines hierarchical JSON-based metadata structures for participants• Three interop events were held in 2020
• In production use in Italy, Australia, Sweden• Have already resolved most open issues– Last Implementer’s Draft planned in this quarter– Then advancement to Final status later this year

OpenID for Verifiable Credentials• Family of three specs enabling use of identities that you hold
• Uses the three-party Issuer/Holder/Verifier model– An Issuer creates a Verifiable Credential for you to hold
– You hold it in a Wallet– You present it to a Verifier• Credential format agnostic– Can be used w/ W3C VCs, ISO Mobile Driving Licenses (mDL), SD-JWTs, etc.

• Has good privacy properties– Issuer doesn’t know when/where you’re using the credential• See https://openid.net/openid4vc/

OpenID for Verifiable Credential Issuance• OpenID for Verifiable Credential Issuance specification– https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html• Specifies how to issue Verifiable Credentials to Holder/Wallet• Based on OAuth 2.0• Credential format agnostic– For example, can use with ISO Mobile Driving Licenses (mDL)• Includes issuer-initiated flow
• First Implementer’s Draft approved this month

OpenID for Verifiable Presentations• OpenID for Verifiable Presentations specification– https://openid.net/specs/openid-4-verifiable-presentations-1_0.html• Defines how to present Verifiable Presentations to a Verifier• Based on OAuth 2.0• Credential format agnostic– For example, can use with ISO Mobile Driving Licenses (mDL)• Second Implementer’s Draft approved May 2023
• Actively working towards third Implementer’s Draft

Self-Issued OpenID Provider V2• OpenID Connect Core defined Self-Issued OpenID Provider(SIOP) functionality– Lets you be your own identity provider (rather than a third party)• Self-Issued OpenID Provider v2 specification– https://openid.net/specs/openid-connect-self-issued-v2-1_0.html– Extends initial SIOP functionality to include DIDs as subjects• Credential format agnostic• SIOP being used with ISO Mobile Driving Licenses (mDL)• Implementer’s Draft approved February 2022
– Actively working towards second Implementer’s Draft

Native SSO Specification• OpenID Connect Native SSO for Mobile Apps specification– https://openid.net/specs/openid-connect-native-sso-1_0.html• Enables Single Sign-On across apps by the same vendor• Assigns a device secret issued by the Authorization Server• Deployed by AOL• Became an Implementer’s Draft in December 2022

Second Errata Set• Edits were performed to address outstanding errata issues– Updates to Core, Discovery, Registration, and Backchannel Logout• Errata updates do not change the meaning of the specs• Second Errata Set published December 2023

ISO Publicly Available Submission (PAS)for OpenID Connect
Submission of OpenID Connect specs for republication by ISO/IEC JTC 1▪ Will enable use of OpenID Connect in jurisdictions requiring specs by treaty organizations▪ Submission accepted, January 2024
▪ No changes were made to the submitted specifications, other than adding ISO title pages▪ ISO spec numbers assigned, February 2024
▪
▪
▪
▪
▪
▪
▪
▪
▪

ISO/IEC CD 26131: Information technology — OpenID Connect Core 1.0
ISO/IEC CD 26132: Information technology — OpenID Connect Discovery 1.0
ISO/IEC CD 26133: Information technology — OpenID Connect Dynamic Client Registration 1.0
ISO/IEC CD 26134: Information technology — OpenID Connect RP-Initiated Logout 1.0
ISO/IEC CD 26135: Information technology — OpenID Connect Session Management 1.0
ISO/IEC CD 26136: Information technology — OpenID Connect Front-Channel Logout 1.0
ISO/IEC CD 26137: Information technology — OpenID Connect Back-Channel Logout 1.0
ISO/IEC CD 26138: Information technology — OAuth 2.0 Multiple Response Type Encoding Practices
ISO/IEC CD 26139: Information technology — OAuth 2.0 Form Post Response Mode

▪ Publication as ISO specs expected after five-month ISO balloting period

Related OpenID Working Groups• Mobile Operator Discovery, Registration, & autheNticAtion(MODRNA)– Mobile operator profiles for OpenID Connect• Financial-grade API (FAPI)– FAPI used for Open Finance in jurisdictions including UK, Australia, Brazil,
Saudia Arabia, Norway, Germany, Japan, Canada, & more to come…

• eKYC and Identity Assurance (eKYC-IDA)– Defines JWT format for verified claims with identity assurance information• Digital Credentials Protocols (DCP)– Future home of OpenID for Verifiable Credentials (OpenID4VC)
specifications

Identity Assurance Specification(Related Work in eKYC-IDA WG)• OpenID Connect for Identity Assurance– https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html• JWT representation for verified person data
– Including information about the identity verification performed– Enables legal compliance for some use cases• Moved to eKYC and Identity Assurance working group in 2019
• Fourth Implementer’s Draft approved October 2022

CIBA Core
(Related Work in MODRNA WG)• OpenID Connect Client-Initiated Backchannel Authentication(CIBA) Core– https://openid.net/specs/openid-client-initiated-backchannelauthentication-core-1_0.html• Authentication flow with direct Relying Party to OpenID
Provider communication without redirects through browser• Used by FAPI CIBA Profile• Became Final in September 2021

What is OpenID Certification?
• Enables OpenID Connect (and FAPI) implementations to be certified
as meeting the requirements of defined conformance profiles– Goal is to make high-quality, secure, interoperable implementations thenorm• An OpenID Certification has two components:– Technical evidence of conformance resulting from testing– Legal statement of conformance• Certified implementations can use the“OpenID Certified” logo
• 3,532 total certifications to date!

What value does certification provide?
• Technical:– Certification testing gives confidence that things will “just work”– No custom code required to integrate with implementation– Better for all parties– Relying parties explicitly asking identity providers to get certified• Business:– Enhances reputation of organization and implementation– Shows that organization is taking interop seriously– Customers may choose certified implementations over others

OpenID Connect Certification Profiles• Authentication– Basic Flow
– Implicit Flows– Hybrid Flows– Third Party-Initiated Login Flow

• Discovery (OP Metadata)• Dynamic Client Registration• Logout– RP-Initiated Logout– Session Management– Front-Channel Logout– Back-Channel Logout• Form Post Response Mode

OpenID Connect OP Certifications• OpenID Provider certifications at
https://openid.net/certification/#OPs– 616 profiles certified to date for
160 deployments• Recent additions:– Duende Software, MonoCloud, Myself,
SAP, Scrive AB, Tiago Cardoso• Each entry link to zip file with test
logs and signed legal statement– Test results available for public
inspection

OpenID Connect RP Certifications• Relying Party certifications at
https://openid.net/certification/#RPs– 127 profiles certified to date for
43 deployments• Recent additions:– Echoworx, Erlang Ecosystem
Foundation, Filip Skokan

Use of Self-Certification• OpenID Certification uses self-certification– Party seeking certification does the testing– (rather than paying a 3rd party to do the testing)• Simpler, quicker, less expensive, more scalable than 3rd party
certification• Results are nonetheless trustworthy because– Testing logs are made available for public scrutiny– Organization puts its reputation on the line by making a publicdeclaration that its implementation conforms to the profile beingcertified toHow does OpenID Certification work?
• Organization decides what profiles it wants to certify to– For instance, “Basic OP”, “Config OP”, and “Dynamic OP”• Runs conformance tests publicly available athttps://www.certification.openid.net/• Once all tests for a profile pass, organization submits certification
request to OpenID Foundation containing:– Logs from all tests for the profile– Signed legal declaration that implementation conforms to the profile• Organization pays certification fee (for profiles not in pilot mode)• OpenID Foundation verifies application is complete and grants
certification• OIDF lists certification at https://openid.net/certification/

What does certification cost?
• Not a profit center for the OpenID Foundation– Fees there to help cover costs of operating certification program• Member price– $700• Non-member price– $3500• New profiles in pilot mode are available to members for free
• Costs described at https://openid.net/certification/fees/

Example Testing ScreenLog from a Conformance Test

Certification of Conformance• Legal statement by certifier
stating:– Who is certifying– What software– When tested– Profile tested• Commits reputation of certifying
organization to validity of results

How does certification relate tointerop testing?
• OpenID Connect held 5 rounds of interop testing – see
http://osis.idcommons.net/– Starting over a decade ago!
– Each round improved implementations and specs– By the numbers: 20 implementations, 195 members of interop list, > 1000
messages exchanged• Recently multiple interop testing rounds for OpenID Connect Federation• With interop testing, by design, participants can ignore parts of the specs• Certification raises the bar:
– Defines set of conformance profiles that certified implementations meet
– Assures interop across full feature sets in profiles

Can I use the OpenID Certification site forinterop testing?
• Yes – please do!
• The OpenID Foundation is committed to keeping theconformance test sites up and available for free to all• Many projects using conformance testing for regression testing– Once everything passes, you’re ready for certification!

• Test software is open source using Apache 2.0 license– Some projects have deployed private instances for internal testing– Available as a Docker container

Favorite Comments on OpenID Certification• Eve Maler – VP of Innovation at ForgeRock– “You made it as simple as possible so every interaction added value.”• Jaromír Talíř – CZ.NIC– “We used and still are using certification platform mainly as testing tool for our
IdP. Thanks to this tool, we have fixed enormous number of bugs in our platform
an even some bugs in the underlying library.”• Brian Campbell – Distinguished Engineer at Ping Identity– “The process has allowed us to tighten up our implementation and improve on
the already solid interoperability of our offerings in the OpenID Connect
ecosystem.”• William Denniss – Google– “We have built the RP tests into the continuous-integration testing pipeline for
AppAuth.”What’s new for OpenID Certification?
• Certification program is now financially self-supporting!
– Open Banking certifications from Brazil and other places got us there• OpenID4VC certification tests (for OpenID4VP) started• eKYC-IDA certification tests planned• OpenID Federation tests planned

OpenID Certification Call to Action• Test your OpenID Connect and FAPI implementations now– And once you’re ready, certify!

• Join the OpenID Foundation and/or the OpenID Connect
working group

OpenID Connect Resources• OpenID Connect– https://openid.net/connect/• Frequently Asked Questions– https://openid.net/connect/faq/• OpenID Connect Working Group and Specs Status Page
– https://openid.net/wg/connect/ and https://openid.net/wg/connect/status/• OpenID for Verifiable Credentials– https://openid.net/openid4vc/• OpenID Certification Program– https://openid.net/certification/• Certified OpenID Connect Implementations Featured for Developers– https://openid.net/developers/certified/• Mike Jones’ Blog
– https://self-issued.info/

Open Conversation• How are you using OpenID Connect?
• What would you like the working group to know or do?
• Slides will be posted at https://self-issued.info/

BACKUP SLIDESAggregated Claims
Data
SourceData
SourceSigned Claims
Identity
ProviderClaim Values

RelyingParty

Distributed Claims
Data
SourceData
SourceSigned Claims
Identity
ProviderClaim Refs

RelyingParty