# A Dynamic Federated Identity Management Using OpenID Connect
## 1 Introduction  
The growth in the use of business outsourcing and collaborative platforms causes demand for organizations to share the identity information they maintain about their users with other partners. Collaboration and sensitive data sharing are protected by the legislation of the organizations' countries. However, the sensitive data should not be transmitted on the Internet insecurely since it creates security and privacy risks. Organizations adhere to federated environments using a federated identity management (FIM) standard to cope with this growth and to add value to the business by allowing third parties services. The literature in the past decade has been proposing different approaches for establishing trust federation. Many problems and concerns might arise when it comes to managing and securing users' accounts, identifiers and passwords in a highly dynamic and insecure environments. Therefore, establishing an identity trust federation between an organization and another entity removes the complexity and concerns regarding identity management for organizations, allowing them to focus on providing the services they want and delegate the identity management tasks to specialized entities. The state of identity management today relies on federation protocols, such as the Security Assertion Markup Language (SAML), Open Authentication 2.0 (OAuth 2.0) and OpenID Connect (OIDC) for external communication of identity credentials. SAML allows the exchange of user authentication and information using XML between different domains [1], OAuth 2.0 allows users to give applications permissions to access resources on their behalf [2], and OIDC allows identity to be communicated in a RESTful-like manner [3]. Identity federation allows one to link a user's digital identities across several identity management systems. When an organization needs to collaborate with a partner's platform,the organization does not release a copy of the user's store (user's credentials) in order to allow the user to authenticate with the partner's platform. Instead, the organization provides an identity management system to the partner's platform to utilize the stored identities, given that the organization trusts the business partner's platform. Therefore, an identity federation protocol allows the decoupling of the authentication and the authorization functions, removes the security risk for managing multiple credentials by the organization users and creates a safe channel for identities to be shared across different domains. The adoption of IoT solutions, such as smart-home and e-health, raises a new security concern that requires providing an identity federation framework [4; 5]. The information between multiple IoT devices should be seamlessly exchanged across all domains to achieve authentication and authorization. For example, in an e-health IoT service, users are able to use their single account for all the e-health provider's services for all the IoT devices via identity federation [4]. Although organizations gain significant business value using identity federation management techniques, they continue to face major obstacles especially when it comes to scaling up to hundreds of business partners [1]. Each business partner might use different identity federation architectures, which raises an issue in interoperability between those different federation architectures [6]. OIDC [3] is a common authentication protocol and its popularity has been increasing enormously since its launch in 2014. A large number of online applications are adopting OIDC protocol to allow them to request and receive information about the authenticated end-user without the hassle of managing end-users' identities. Users can see OIDC when a web applications allows them to sign in using Facebook, Google, Microsoft's Office 365 or other OPs.