Repository navigation
Support for OpenID Federation 1.0 #31027
Replies: 12 comments 9 replies
|
I am part of the team originally implemented keycloak-oidc-federation. It is a previous work based in previous draft (13) and previous Keycloak (version 11). The work has been abandoned and is not used in any of our Keycloak instances. Our implementation is only for explicit registration. Our Keycloak community PR is also for automatic configuration. Our initial plan is to start implementing it again from October. We want to support it for European Digital Identity Framework and eduGAIN profile for OpenID Federation in our Research & Education Keycloak installation. Thanks @thomasdarimont for your work in this and updating our extension. We believe that Keycloak should try supporting OpenID Federation. We could start with some features as an experimental feature in Keycloak core. We could discuss a collaboration/ help for it based on availability. |
|
We will leverage OpenID Federation to enable Automatic Client Registration within the context of the European FIDA and also backport our implementation of the European PSD2/PSD3/PSR regulations. In mainland Europe, proprietary protocols like the Berlin Group Open Finance - NextGenPSD2 API Framework currently utilize eIDAS certificates issued by accredited certification authorities to build trust. Combining these eIDAS certificates with Entity Statement can provide a robust mechanism for Automatic Registration of Clients within the European PSD/PSR/FIDA ecosystem. |
|
Just for information from today's breakout session: https://www.ietf.org/archive/id/draft-parecki-oauth-client-id-metadata-document-01.html |
|
In these couple of months, I have started looking into OpenID Federation spec for implementation with Keycloak since I found out this interesting proposal: Right nowI, I am working on the @thomasdarimont ’s branch (updated version based on Keycloak 25) to deploy in my local environment. [Question] |
|
did you find the reason for the error? |
|
Hi, we were using your project to try to customise our own IdP/OIDC. Is the POST API correctly used? Are there any known issues about this problem while persisting? This is the JSON Body used in the API: This is the detailed StackTrace: We are developing under the Docker distribution, with PostgreSQL:16 and Quarkus Thanks in advance! |
|
I have just created a PR for updated version based on Keycloak 25. And I guess that the pull request could resolve your issue too. |
|
Some update information related to OpenID Federation;
|
@bucchi Do you know if plugin bypass OIDF Federation tests for explicit registration?
Very interesting event.
|
|
I agree with you. Keycloak was not ready for that event at that time and I guess nobody from Keycloak participated in the event. But someone who participated in the event from a company called radiam ( https://www.raidiam.com/ ), gave me some messages in my linkedin account after reading my article on Medium.com. And they asked me if I am interested in integrating Keycloak with their Trust Anchor service of OpenID Federation. Is it pretty interesting to you guys, also? Let us discuss how we can work on about that. |
We have create a dummy OpenId Federation with docker compose from .,https://github.com/go-oidfed/lib/tree/main/examples/edugain-pilot. I could provide details if needed. |
|
Hey, guys! The implementation for Keycloak 26's documentation says that it's based on draft 13 and checking the code, it indeed doesn't support features like automatic registration. OpenID Federation draft has evolved quickly and is now on its 43rd version. Searching on the web, I didn't find any other implementation of |
|
@eduperottoni I agree. @eduperottoni @thomasdarimont @bucchi I have created jira epic for the need of implementaion of Openid Federation. |
|
Great, @cgeorgilakis! Thanks for sharing! We can help in the implementation, since we are interested in |
|
@cgeorgilakis, I love your proposal. I am in, too!! BTW, as I posted here ( #31027 (reply in thread) ), I got some proposal for integrating Keycloak with the real Trust Anchor service of OpenID Federation out there. I guess it could be a pretty good target for us. |
|
For having tests for explicit client registration - as I guess the same issue is valid for automatic registration-, we need to moch the following REST API responses of Trust anchor:
So, the question , mainly for Keycloak team @thomasdarimont, is how could we implement this two mock services? Should we use old or new test framework? |
|
I have implemented the first PR related to OpenID Federation as Keycloak being an OP with explicit registration. Moreover, I will have the presentation 'Keycloak & OpenID Federation: Empowering Dynamic Trust in Federated Environments' in KeyConf25 in 28 August in Amsterdam. See you there. |
|
I think it would make a lot of sense to build on the concept of identity providers to provide this trust relationship rather than introducing a whole new thing. See #42197 Also, look at #42229 (client assertions via 3rd party OIDC) or #42314 (client assertions via SPIFFE). |
The OpenID Federation and SPIFFE share similar goals while addressing different aspects of identity management. Both aim to enhance the trust and scalability of OIDC/OAuth ecosystems. OpenID Federation is developed by the OpenID Connect Working Group, being nearing its Final Specification. It has gained strong interest among others from leading technology companies (fe authors, dedicated events). Most important implementation is EU wallet ecosystem (OpenID Federation Wallet Architectures), which supports linking national wallets, identity providers, and relying parties. It is combined with OpenID4VCI that Keycloak aims to preview it. I propose rebasing my draft PR to align with the ongoing SPIFFE-related work and @bucci’s test implementations, aiming to finalize it when possible. Alternatively, @bucci could create a dedicated PR for Automatic Client Registration, including only the relevant parts from my draft PR. |
|
OpenID Federation is Final specification from 17 February. We will be glad to rebase my draft PR and proceed the talk for supporting OpenID Federation in Keycloak, if there is interest from Keycloak team. Full tests for OpenID Federation need more time and investigation as there is need to mock Trust Anchor and RP/OP responses. Any help is welcome. |
|
Regarding the challenge of mocking Trust Anchor endpoints for testing (.well-known/openid-federation and federation_fetch_endpoint), I'd like to point to @oidfed — a complete, OpenID Federation 1.0 implementation for JavaScript/TypeScript, aligned with the Final specification (Feb 2026). The @oidfed/authority package can spin up a spec-compliant Trust Anchor with both required endpoints wired out of the box, making it usable as a lightweight federation fixture in the Keycloak test suite — no handcrafted JWT mocks needed. It covers both explicit and automatic client registration via @oidfed/oidc. For zero-setup exploration, the live explorer at https://explore.oidfed.com can resolve and inspect trust chains against any federation endpoint, including a Keycloak instance exposing /.well-known/openid-federation. GitHub: https://github.com/Dahkenangnon/oidfed Project home: https://oidfed.com/ |
Uh oh!
There was an error while loading. Please reload this page.
The following discussion briefly explains what OpenID Federation is about and asks the community to provide some feedback on the following question: "How would you benefit from having OpenID Federation support in Keycloak?"
OpenID Federation
The OpenID Federation (OIDFED) protocol, which Keycloak now supports, defines a highly scalable architecture for establishing trust between multiple parties based on JWT/JOSE artifacts, ensuring that your system can grow with your needs.
At a high level, this protocol enables the following use cases:
Even though the current OpenID Federation 1.0 standard document is still a draft (draft 36), it is under active development and is already used by large institutions and some governments.
According to this presentation by one of the spec authors:
The core components have been stable since draft 20 (now at draft 36). Useful (optional) backward-compatible features have been added. The Last Implementer’s Draft is imminent, and the final specification is anticipated for later this year.
Discussions on OpenID Federation support and Keycloak
In the past, there was some community interest in Keycloak supporting the OpenID Federation standard.
Existing PoCs
Additional links
All reactions