Celebrating Ten Years ofOpenID Connect
Michael B. Jones

Self-Issued Consulting

Looking Back and Looking Forward• OpenID Connect became final in February 2014
• Today I’ll briefly share my thoughts on• How we created OpenID Connect• What we achieved together• Lessons learnedIn the Beginning• Artifact Binding for OpenID 2.0 started in 2010
• Hence the openid-specs-ab@lists.openid.net mailing list name• But developers were choosing JSON/REST over XML/SOAP• Pivoted to instead create JSON/REST protocol over OAuth 2.0• Result branded “OpenID Connect” at IIW in May 2011
• Five rounds of interop testing between 2011 and 2013!
• Specifications refined after each round of interop testing• Early developer feedback was pricelessDesign Philosophy• Keep simple things simple• Make complex things possible

The Nov Matake Test
• As we considered newfeatures, we’d ask ourselves:• Would Nov want to add it tohis implementation?
• Is it simple enough that hecould build it in a few hours?

Broad Participation

OpenID Connect

Learning from the Past
• Architects had extensive SAML and OpenID 2.0 experience• Borrowed ideas that already worked well
• Metadata• Authentication Contexts• Added useful things that were previously hard or missing• Support for native applications• Encrypted claims• Signed requests

Extensible by Design• Successful systems have to adapt and grow
• Always specified that “additional values may be used”• And specified that not-understood values don’t cause errors• Enables adding things without breaking existing deployments• Indeed, many successful Connect (and OAuth) extensions havebeen created and deployed• Including logout and identity assurance

Built using Modular Components• Created components and features we needed in parallel• JSON Web Signature (JWS)• JSON Web Encryption (JWE)• JSON Web Key (JWK)• JSON Web Token (JWT)• WebFinger• ID TokenWhat We Achieved• Most used identity protocol• Thousands of interoperableimplementations• In every conceivable language• Certification Program making
interop a reality• ISO accepted our submission
for republication

Innumerable OpenID Connect Deployments• Android, AOL, Apple, AT&T, Auth0, Deutsche Telekom,ForgeRock, Google, GrabTaxi, GSMA Mobile Connect,IBM, KDDI, Microsoft, NEC, NRI, NTT, Okta, Oracle,Orange, Ping Identity, Red Hat, Salesforce, Softbank,Symantec, Telefónica, Verizon, Yahoo, Yahoo! Japan, alluse OpenID Connect• And many MANY more!

Lessons Learned• Developers choose things that are simple• Developer choice critical to adoption• Interoperability and security require rigorous testing• OpenID Certification program was essential to Connect’s success• Extensibility is critical to long-term success• Deployments have to be easy to use (or they won’t be used)• Most RPs limited IdP choice as a simplification• Even though Connect was designed to give users complete choice• Not everything works out the way you planned• Developer and deployer feedback is gold!

OpenID and the Enterprise
Chuck Mortimore
Disney (Salesforce at the time)

What I think I was saying:• Canonicalization is hard regardless of serialization• We are unwilling to implement WS-* and need an objection handler.

What actually happened:• Simplicity won: WS-* was replaced*• We created the Basic Implementors draft*and almost all of the same patterns exist in our current standards stackWhat I think I was saying:
Enterprises are adopting iPhones and we’re not ready• We need fine grained control over app and data access• We need to federate with mobile apps

What actually happened:• Application frameworks for contextual policy• Embedded WebView in mobile apps == reuse of web federation

What I think I was saying:• The firewall is moving around and loosing importance• Core services, including identity, will move to the cloud

What actually happened:
Artifact profiles that actually scale
SSO get tokens
Applications become composites

What I think I was saying:• Cloud adoption is just-in-time for certain users/companies• SAML JIT works but integration heavy• I miss LDAP and it’s standard yet extensible schema

What actually happened:• Standardized schema• SCIMWhat I think I was saying:• Enterprises are complex ecosystems and 1 IDP doesn’t cut it• Despite empirical lack of success, user-centric is important

What actually happened:• Cloud IDPs
• New Types of Identity Discovery• User-centric becomes SSI and it still seeking scale25 years of OpenID~ at the 10th Anniversary of the OpenID Connect Final

Nat Sakimura

Chairman of the board, OpenID Foundation_nat

https://www.sakimura.org

https://youtube.com/@55id
https://www.linkedin.com/in/natsakimura

OpenID 1.0

Brad Fitzpatrick
et al.

1999

2001

OpenID.net
David Lehn

2007

2014

OpenID 2.0

OpenID
Connect

David Recordon
et al.

Nat Sakimura
et al.

XNS.org

Drummond Reedet al.

1999

2001

OpenID.net
David Lehn

OpenID 1.0

Brad Fitzpatrick
et al.

2007

2014

OpenID 2.0

OpenID
Connect

David Recordon
et al.

Nat Sakimura
et al.

OpenID Authentication 2.0(key=value)

XNS.orgDrummond Reedet al.

1999

Brad Fitzpatrick
David RecordonJosh Hoyt

SAML 1.0

2001

OpenID 1.0

Brad Fitzpatrick

2002

OpenID.net
David Lehn

2005

SAML 2.0(XML,XML DSIG,SOAP)

2007

2014

OpenID Authentication 2.0(key=value)

XNS.orgDrummondReed

1999

Brad Fitzpatrick
David Recordon
Josh Hoyt

SAML 1.0

2001

OpenID 1.0

Brad Fitzpatrick

2002

OpenID.net
David Lehn

2005

SAML 2.0(XML,XML DSIG,SOAP)

OpenID AX
Dick Hardt

2007 2008

OAuth 1.0
(Key=value)

E. Hammer-Lahav

OpenID TX/CX
Proposal
Nishitani/Sakimura

2012

2014

20072008

UntrustedApps

Give passwords (full right) to all ofthem?

Bad Idea

Audienced identity&Minimum accessauthorization

ID Token&Access TokenProblems of SAML, OpenID
Authentication 2.0, OAuth 1.0

OpenID Authentication 2.0(key=value)

XNS.orgDrummondReed1999

Brad Fitzpatrick
David Recordon
Josh Hoyt

SAML 1.0

2001

OpenID 1.0

OpenID AX

2005

2007 2008 2009

Brad Fitzpatrick

2002

OpenID.net
David Lehn

SAML 2.0(XML,XML DSIG,SOAP)

Dick Hardt

2012

2014

OAuth 1.0
(Key=value)

E. Hammer-Lahav

OpenID TX/CX
Proposal
Nishitani/Sakimura

FAPI

OpenID Authentication 2.0(key=value)

XNS.orgDrummondReed1999

Brad Fitzpatrick
David Recordon
Josh Hoyt

SAML 1.0

2001

OpenID 1.0

Brad Fitzpatrick

2002

OpenID.net
David Lehn

2005

SAML 2.0(XML,XML DSIG,SOAP)

OpenID AB WG(Key=value?)

OpenID AX
Dick Hardt

2007 2008 2009 2010

OAuth 1.0
(Key=value)

E. Hammer-Lahav

OpenID TX/CX
Proposal
Nishitani/Sakimura

2012

2014

Nat Sakimura

John Bradley(NRI [当時])(Mercenary workingfor NRI [当時])Breno de Madeiros(Google)Nat Sakimura

John Bradley(NRI [当時])(Mercenary workingfor NRI [当時])Breno de Madeiros

Ryo ItoHideki Nara

(Yahoo! Japan [当時])(Tact [当時])(Google)51

Early design decisions:
1.
2.

3.
4.

No canonicalization
ASCII Armoring
JSON
JSON Simple
RESTSignature (JSS)& Encryption (JSE)52

Then, there
was a parallelwork

MagicSignature &JSON Token

Dirk Balfanz

John Panzer

53

And there came Mike Jones► “You guys should come together and standardize it at

IETF. Don’t worry. I can take care of the editing!”

JSON Simple
Signature (JSS)& Encryption (JSE)
Magic Signature &JSON Tokens

JWx

JWx

JWS: JSON Web Signature►JWE: JSON Web Encryption►JWT: JSON Web Token etc.
►54Early design decisions:
1.
2.
3.
4.
5.

No canonicalization
ASCII Armoring
JSONRESTJWx

55

56

Early design decisions:
1.

2.
3.

4.
5.
6.

No canonicalization
ASCII ArmoringJSONRESTJWx
Base on OAuth WRAP 2.0

Dick Hardt

Allen TomOpenID Authentication 2.0(key=value)

XNS.orgDrummondReed

1999

Brad Fitzpatrick
David Recordon
Josh Hoyt

SAML 1.0

2001

OpenID 1.0

Brad Fitzpatrick

2002

OpenID.net
David Lehn

2005

SAML 2.0(XML,XML DSIG,SOAP)

OpenID AB WG(Key=value?)

OpenID Connect
1.0

OpenID AX
Dick Hardt

2007 2008 2009 2010

OAuth 1.0
(Key=value)

E. Hammer-Lahav

OpenID TX/CX
Proposal
Nishitani/Sakimura

2012

2014

OAuth 2.0
(Key=value)
Dick Hardt

What we have achieved

ID Token
JWS/JWE/JWKSOAuth 2.0
HTTPS

A protocol thatdefines for a client
how to request andfor the server toprovide the ID TokenThat is perfectly fit for modern identityand access control frameworks
PAP
Admin

EntityAuthentication Server

PDP
Authenticated Identity

Provides Claims

AuthN
usernamepassword
Geo-location
Device info
Etc.

RealName

metadata

PEP
Resource

EmployeenumberProfessional
qualification

Identity
RegisterPolicy

PEP2

department
Geo-location

ID Token

Audit
Log Anomaly
Detection

The mainstream federated identity system►►

Social Login
National Identity

The mainstream federated identity system►►Social Login
National Identity(Source) Based on https://www.namirial.com/en/news/state-of-play-onadoption-of-digital-identity-in-italy-2023-all-roads-lead-to-the-wallets/

Formed the basis of Open Finance
FAPI 1.0 ID2
with GOST cryptoalgorithm

HelseID

FDXOpen Banking
UKlive 2019 yes/VerimiOpen Banking

OpenFinance
OpenInsurance
live July 2021

Minna No Ginko+recommendation
bybankingassociation

Consumer Data
Right
live July 2020ConnectID

How we achieved it
Listening to developer feedback
Solve what was not solved
No Canonicalisation

Dead Simple for simple use-cases
Security and Privacy Facilities

What lessons we learned that could apply toother initiatives
Learn from History

Make it simple to read,
simple to implement for theminimum viable case
Find the developer pain andsolve it

OpenID: there is nospoon

John
Bradley
Principal Architect
Yubico
AKA Mercenary

OpenID is more than a single specification or Idea

Insert inciteful comment….