# A Dynamic Federated Identity Management Using OpenID Connect
## 4 Experimental Environment and Implementation
### Dynamic OIDC Trust Framework
{ \"keys\": [  
{ \"kty\": \"RSA\", \"use\": \"sig\", \"alg\": \"RS256\", \"kid\": \"ZhaR-H6 Nug-3 jEU0 jdUw=XP1 NIM\", \"x5t\": \"ZhaR-H6 Nug-3 jEU0 jdUw=XP1 NIM\", \"n\": \"xCixm91 WJoqHsXhnVYbwek_8 Yxf22 ica5 rh10v1 Ez_Woy0F0i..\", \"e\": \"AQAB\", \"X5c: [  
\"MIIC*jCCAdqawIBAgIQDupdR+gtaZCyz1j7+XF1 DANBkgqhkiG9w..\"  
} ]  
5. AdvertiseMe validates the registration request through the following steps: * First, AdvertiseMe validates the digital signature of the JWT using the certificate extracted from the JWT header. If the signature cannot be validated, the request is denied. Validating the signature establishes the client control of the certificate's private key. * Second, a certificate path building and validation is performed. This process is required by the RP to verify the integrity and trustworthiness of all the certificates in a certificate chain that was used to sign a JWT. * The third step is validating the claims inside the JWT payload. If any of the claims is invalid or missing, the registration request is denied. 6. If the request is valid, the authorization server (AdvertiseMe) returns a response indicating a successful client registration. The registration response should contain a client_id claim containing the new client identifier issued by the authorization server. So far, the main concern was to establish a federated identity between a client (FlyerIt) and an authorization server (AdvertiseMe). Establishing this trust allows end-users to use their identity as a unified identity that serves them in the open world. Now, [PERSON] can utilize his organization identity to access the full services of FlyerIt since a trust federation environment was established between FlyerIt and AdvertiseMe. All users coming from the organization will be able to log in to FlyerIt and even achieve this with a single sign-on (SSO) solution. Figure 6 illustrates how FlyerIt can sign in [PERSON], retrieve his basic profile information and allow him to use the services provided. 1. [PERSON] requests to sign in to FlyerIt using his AdvertiseMe credentials. 2. Since FlyerIt had previously dynamically discovered and registered with the AdvertiseMe identity provider, it redirects [PERSON] to AdvertiseMe's authorization endpoint initiating the authorization code flow. Other grant types might be used; we used the authorization code flow. GET /authorize? response_type=code& scope=openid& scope=openid& state=state_value&  
Figure 5: Sample Registration JWT. client_id=registered_client_Id& _redirect_uri=[[https://flyerit.com/callbackHTTP/1.1](https://flyerit.com/callbackHTTP/1.1)]([https://flyerit.com/callbackHTTP/1.1](https://flyerit.com/callbackHTTP/1.1)) Host: identity.advertiseme.com_
3. [PERSON] is redirected to his company's login page to authenticate himself and to authorize FlyerIt to access his basic information. 4. When [PERSON] authorizes FlyerIt to the requested resources, AdvertiseMe returns an authorization code to FlyerIt by redirecting [PERSON] to the redirect_uri that was presented in the authorization request, which is [[https://flyerit.com/callback1](https://flyerit.com/callback1)]([https://flyerit.com/callback1](https://flyerit.com/callback1)) in our example, and returns the authorization code response. HTTP/1.1 302 Found Location: [[https://flyerit.com/callback1?](https://flyerit.com/callback1?)]([https://flyerit.com/callback1?](https://flyerit.com/callback1?)) code=authorization_code& state=state_value
5. In the authorization code flow, the client usually submits an authorization code along with his clientId and clientSecret to the authorization server's token endpoint to receive an access_token and an id_token. In our case, there was no clientSecret assigned to FlyerIt; instead, FlyerIt prepares an authentication statement similar to the registration statement it prepared for the dynamic registration process. The authentication statement is a signed JWT that contains the following claims:  
* An \"iss\" claim that holds a URI identifying the issuer, which is FlyerIt in our case.