OpenID Connect Working Group Update
April 15, 2023
Michael B. Jones
Self-Issued Consulting1

OpenID Connect Working Group Overview
Initiatives of the Working Group▪ Created the OpenID Connect protocol, enabling login and logout▪ Incubated OpenID Connect for Identity Assurance work▪

Now in the eKYC-IDA WG▪ Developing OpenID Federation, enabling trust establishment among cooperating parties▪ Incubated OpenID for Verifiable Credentials specifications▪

Transfer of the OpenID4VC specs to the Digital Credentials Protocols (DCP) working group is
anticipated after OpenID Connect WG Implementer’s Drafts are approved▪ See the list of specs and descriptions at https://openid.net/wg/connect/specifications/2OpenID Connect Working Group Specifications
Final Specifications▪ OpenID Connect (Core, Discovery, Dynamic Client Registration, Multiple Response Types, Form
Post Response Mode, RP-Initiated Logout, Session Management, Front-Channel Logout, BackChannel Logout)▪ OpenID 2.0 to OpenID Connect Migration▪ Error Code unmet_authentication_requirements▪ Initiating User Registration via OpenID Connect
Specifications Under Development▪ OpenID Federation▪ OpenID for Verifiable Credentials (Self-Issued OpenID Provider V2, OpenID for VerifiablePresentations, OpenID for Verifiable Credential Issuance)▪ UserInfo Verifiable Credentials▪ Claims Aggregation▪ Native SSO for Mobile Apps

3

Working Group Progress & Opportunities
Working group deliverables since last workshop in October 2023
▪ Second Errata Set for OpenID Connect specifications published, December 2023
▪ ISO Publicly Available Submission (PAS) submission accepted, January 2024 (see next slide)▪ First Implementer’s Draft of OpenID for Verifiable Credential Issuance specification, April 2024
▪ Multiple OpenID Federation drafts published▪
▪

Federation Operators section rewritten for clarity
Working towards final Implementer’s Draft▪ Multiple OpenID4VC drafts published (described in the DCP WG presentation)
Challenges and opportunities facing the working group▪ OpenID Federation in production use▪
▪
▪

In Italy, both for national federations and EU wallet ecosystem
In Australia, for FAPI trust establishment
In Sweden, for national federations▪ Relationships with digital wallet initiatives and national identity systems worldwide

4

ISO Publicly Available Submission (PAS) for OpenID Connect
Submission of OpenID Connect specs for republication by ISO/IEC JTC 1▪ Will enable use of OpenID Connect in jurisdictions requiring specs by treaty organizations▪ Submission accepted, January 2024
▪ No changes were made to the submitted specifications, other than adding ISO title pages▪ ISO spec numbers assigned, February 2024
▪
▪
▪
▪
▪
▪
▪
▪
▪

ISO/IEC CD 26131: Information technology — OpenID Connect Core 1.0
ISO/IEC CD 26132: Information technology — OpenID Connect Discovery 1.0
ISO/IEC CD 26133: Information technology — OpenID Connect Dynamic Client Registration 1.0
ISO/IEC CD 26134: Information technology — OpenID Connect RP-Initiated Logout 1.0
ISO/IEC CD 26135: Information technology — OpenID Connect Session Management 1.0
ISO/IEC CD 26136: Information technology — OpenID Connect Front-Channel Logout 1.0
ISO/IEC CD 26137: Information technology — OpenID Connect Back-Channel Logout 1.0
ISO/IEC CD 26138: Information technology — OAuth 2.0 Multiple Response Type Encoding Practices
ISO/IEC CD 26139: Information technology — OAuth 2.0 Form Post Response Mode

▪ Publication as ISO specs expected after five-month ISO balloting period

5Working Group Roadmap

6

DATE

DELIVERABLESASPIRATIONSNOTES

Q2 2024

Final OpenID FederationImplementer’s Draft

Finish bringing text up to OpenID
Connect quality standards

Can discuss specifics this week

Q3 2024

ISO PAS specifications for
OpenID Connect published

Make OpenID Connect specs
available to those with treatybased procurement processes

ISO publication expected after
conclusion of five-month ballot
periodQ4 2024

Final Federation Spec

Trust establishment for broad setof use cases

Having Final spec will accelerate
deployments

Tenth Anniversary of OpenID Connect▪ OpenID Connect specifications were approved in February 2014
▪ Three celebrations are being held▪
▪
▪

January 2024 at Japan OpenID Summit in Tokyo
May 2024 at Identiverse in Las Vegas
June 2024 at EIC in Berlin▪ Presentations from first celebration published at https://self-issued.info/?p=2481▪ During the celebrations, we are sharing our perspectives on▪
▪
▪

How we developed OpenID Connect
Why it succeeded
Lessons we learned along the way▪ Lessons learned▪
▪
▪

7“Keep simple things simple”
Repeated interop testing and incorporating resulting feedback from developers was critical
Certification enables an ecosystem of interoperable implementations

What the Working Group Plans to Accomplish at IIW This Week
What sessions do you plan to hold?
What hallway/table conversations do you want to have?
What demos are you presenting?
Logistics:▪ Today’s OpenID Connect working group call cancelled in favor of this workshop▪ Do we want to hold Thursday’s 7am working group call?

8