# A Dynamic Federated Identity Management Using OpenID Connect
## 4 Experimental Environment and Implementation
### Dynamic OIDC Trust Framework  
Although identity federation offers better services to organizations at a lower cost, it also proposes new security threats. These security threats allow malicious entities to use a user's information or web resources. OAuth 2.0, based on a comprehensive threat model developed in 2013 [21], documents additional security considerations that include attacks on OAuth 2.0 tokens and protected resources. However, when it comes to crossing security domains in a federated identity, as well as a dynamic approach to allow discovery and client registration, many more security concerns arise. Thus, the proposed model so far raises some security concerns and is vulnerable to security attacks, such as phishing, broken authentications, replay attacks, on-path attacks, session hijacking, SSRF and code injection. To tackle the security concerns in our proposed model, we propose a new trust model based on the new OIDC federation protocol [10]. This model aims to establish a trust relationship between RPs and OPs. The proposed trust model is built based on PKI. The main goal of this concept is to verify that an RP is the entity it is claiming to be. The proposed trust model first aims to enhance the dynamic discovery model by leveraging digital certificates and PKI. This allows RPs to retrieve OPs' digital certificates upon discovery and validate their integrity and trustworthiness by performing certificate path validation. Accordingly, the RPs are able to identify malicious authorization servers. Second, it aims to enhance the dynamic client registration process by also leveraging digital certificates, which allows a real-time trust assessment and establishment between RPs and OPs. The model forces RPs to create a digitally signed software statement as a registration request and provide it to the authorization server. This in turn allows authorization servers (or OPs) to validate the signature of the statement, prove the possession of a private key and validates the integrity of the client to be registered by evaluating its trust chain for the provided certificate. As a result, malicious RPs are not able to register themselves thus preventing security concerns, such as phishing attacks. Figure 4 illustrates a high level overview of the enhanced model that leverages PKI and digital identities in both dynamic ldP discovery and dynamic client registration. 1. Upon discovery, FlyerIt requests that authorization server's metadata information from a well-known configuration endpoint defined by AdvertiseMe. 2. AdvertiseMe returns all metadata information as a JSON object. 3. FlyerIt should not allow users to be able to authenticate themselves via a malicious organization's authorization server. The least it can do is to verify the identity and the integrity of this organization. Using PKI and certificate path validation, FlyerIt can verify the integrity, trustworthiness and appropriateness of the certificate provided by AdvertiseMe. FlyerIt now can extract the set of certificates provided in the JWKS claim. The claim contains a set of public keys that are used to verify tokens that are issued, signed and sometimes encrypted by the authorization server. The \"x5c\" claim contains the X.509 public key certificate or certificate chain corresponding to the key that is used by the authorization server (i.e., AdvertiseMe) to digitally sign tokens. The value of the \"x5c\" claim is a PEM encoded certificate, which is a block of encoded text that contains all of the certificate information and public key. Once the FlyerIt is in possession of the server's certificate, it can start building a PKI certificate chain from AdvertiseMe's end-entity certificate up to the first root CA that FlyerIt trusts. If the verification is successful, FlyerIt can verify the certificate revocation list, or  
Figure 4: FlyerIt Dynamic Client Registration. CRL, published by the root CA. If the CRL does not indicate any revocation status, AdvertiseMe digital certificate is considered valid and can be relied upon.