# A Dynamic Federated Identity Management Using OpenID Connect
## 3 The Proposed Approach  
To answer the research question and to address the challenge of scaling up organizations, a dynamic federated identity model is proposed by leveraging the OIDC framework to provide organizations the capability to dynamically scale up their businesses and establish an identity federation management framework. The approach defines several models that can be combined and used to achieve a dynamic federation between organizations. As a result, end-users accessing any web-enabled services should be able to use a single identity while accessing all those services. The proposed model is implemented as a proof-of-concept in a controlled environment to help us answer the research question.  
Our identity provider (IdP) was Microsoft Active Directory Federation Services (ADFS), since it supports OIDC authentication. An authorization server proxy was developed to make ADFS support dynamic client registration. Other identity providers that support dynamic client registration could be used instead of ADFS ([[https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)]([https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)), (accessed on 16 November 2022), such as IBM Cloud Identity ([[https://cloud.ibm.com/docs/account?topic=account-iamoverview](https://cloud.ibm.com/docs/account?topic=account-iamoverview)]([https://cloud.ibm.com/docs/account?topic=account-iamoverview](https://cloud.ibm.com/docs/account?topic=account-iamoverview)), (accessed on 16 November 2022), Authelete 2.2 ([[https://www.authlete.com](https://www.authlete.com)]([https://www.authlete.com](https://www.authlete.com)), (accessed on 16 November 2022), Cloudentity ([https://cloudentity.com/why-cloudentity](https://cloudentity.com/why-cloudentity), (accessed on 16 November 2022) and Gluu Server 4.2 ([[https://gluu.org](https://gluu.org)]([https://gluu.org](https://gluu.org)), (accessed on 16 November 2022).  
The proposed model consisted of three major processes necessary for establishing identity federation: dynamic discovery, dynamic client registration and dynamic trust federation establishment.  
1. Dynamic discovery: The dynamic discovery process answers this question to a service provider _\"Where are end-users coming from?\"_. This is necessary in order for an RP to know where and how to authorize end-users for granting them access to its services.
2. Dynamic client registration: In order for an RP to be able to use OIDC services, the RP needs to register with an OpenID provider (OP). The process allows RPs to dynamically register themselves by providing information about themselves and to obtain the necessary information.
3. Dynamic trust federation: The previous two steps do not define a mechanism to establishing a trust between OIDC RPs and OPs. The dynamic trust federation process allows RPs and OPs to dynamically obtain and establish a trust from a common trusted third party. Establishing this trust allows entities to trust the information communicated between each other. An entity can establish a cryptographically based trust relationship with other entities via a certificates exchange that anchors these trust relationships into a trust anchor list. The main purpose of a trust anchor entity is to issue certificates to other entities participating in the trust federation. This way, relying parties can only register with OPs by exchanging certificates in a signed statement whose certificate validates the signature against its trust anchor list.