Skip to content

Apply changes to OpenID Federation 1.0 from 7-Dec-25 to 19-Jan-26 #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
selfissued merged 3 commits into from
Jan 20, 2026
Merged

Apply changes to OpenID Federation 1.0 from 7-Dec-25 to 19-Jan-26 #6

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7274bdc
OpenID Federation 1.0 as of 19-Jan-26
selfissued Jan 20, 2026
1aad255
Resolved merge conflicts
selfissued Jan 20, 2026
7dce3b0
20-Jan-26
selfissued Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
153 changes: 97 additions & 56 deletions openid-federation-1_1.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@
</address>
</author>

<date day="19" month="January" year="2026"/>
<date day="20" month="January" year="2026"/>

<workgroup>OpenID Connect Working Group</workgroup>

Expand Down Expand Up @@ -1003,15 +1003,15 @@
"iss": "https://feide.no",
"sub": "https://ntnu.no",
"iat": 1516239022,
"exp": 1516298022,
"exp": 1516843822,
"jwks": {
"keys": [
{
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"kid": "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs",
"n": "pnXBOusEANuug6ewezb9J_...",
"n": "vHOJrp-zLST7FwvzAwelR9Vo...",
"e": "AQAB"
}
]
Expand Down Expand Up @@ -1424,7 +1424,7 @@
scheme and MAY contain port,
path, and query parameter components;
it MUST NOT contain a fragment component.
Any federation Entity MAY publish a
Any Federation Entity MAY publish a
<spanx style="verb">federation_resolve_endpoint</spanx>.
</t>
<t hangText="federation_trust_mark_status_endpoint">
Expand Down Expand Up @@ -3066,10 +3066,10 @@
Intermediate Entity for its Immediate Subordinates are applied to
the Trust Chain subject <spanx style="verb">metadata</spanx>.
After that, the merged metadata policy is applied, to produce the
following resulting RP's Resolved Metadata:
following resulting RP Resolved Metadata:
</preamble>
<name>
The Resulting RP's Resolved Metadata for the Trust Chain Subject
The Resulting RP Resolved Metadata for the Trust Chain Subject
</name>
<artwork><![CDATA[
{
Expand Down Expand Up @@ -3468,9 +3468,9 @@
{
"alg": "RS256",
"e": "AQAB",
"kid": "key1",
"kid": "Jlob6qNFuSHj3sfuntz9C_9s...",
"kty": "RSA",
"n": "pnXBOusEANuug6ewezb9J_...",
"n": "_LioMsSeycE4pELlpPYgZluB...",
"use": "sig"
}
]
Expand Down Expand Up @@ -3653,10 +3653,10 @@
</name>
<artwork><![CDATA[
{
"iss": "https://rp.example.it/spid/",
"sub": "https://rp.example.it/spid/",
"iss": "https://rp.example.it/spid",
"sub": "https://rp.example.it/spid",
"iat": 1516239022,
"exp": 1516298022,
"exp": 1516843822,
"trust_marks": [
{
"trust_mark_type": "https://www.spid.gov.it/certification/rp",
Expand All @@ -3682,7 +3682,7 @@
"openid_relying_party": {
"application_type": "web",
"client_registration_types": ["automatic"],
"client_name": "https://rp.example.it/spid/",
"client_name": "https://rp.example.it/spid",
"contacts": [
"ops@rp.example.it"
]
Expand Down Expand Up @@ -3963,14 +3963,14 @@
<figure>
<preamble>
The following is a non-normative example of an HTTP GET request for
a Subordinate Statement from edugain.org about https://openid.sunet.se:
a Subordinate Statement from edugain.org about https://sunet.se:
</preamble>
<name>
API Request for a Subordinate Statement
</name>
<artwork><![CDATA[
GET /federation_fetch_endpoint?
sub=https%3A%2F%2Fopenid%2Esunet%2Ese HTTP/1.1
sub=https%3A%2F%2Fsunet%2Ese HTTP/1.1
Host: edugain.org
]]></artwork>
</figure>
Expand Down Expand Up @@ -4003,7 +4003,7 @@ Host: edugain.org
<artwork><![CDATA[
{
"iss": "https://edugain.org",
"sub": "https://openid.sunet.se",
"sub": "https://sunet.se",
"exp": 1568397247,
"iat": 1568310847,
"source_endpoint": "https://edugain.org/federation_fetch_endpoint",
Expand Down Expand Up @@ -4214,7 +4214,7 @@ Host: edugain.org
</name>
<artwork><![CDATA[
GET /list HTTP/1.1
Host: openid.sunet.se
Host: sunet.se
]]></artwork>
</figure>
</section>
Expand Down Expand Up @@ -4245,7 +4245,7 @@ Host: openid.sunet.se
Content-Type: application/json

[
"https://ntnu.andreas.labs.uninett.no/",
"https://ntnu.andreas.labs.uninett.no",
"https://blackboard.ntnu.no/openid/callback",
"https://serviceprovider.andreas.labs.uninett.no/application17"
]
Expand Down Expand Up @@ -4297,7 +4297,7 @@ Content-Type: application/json
<vspace/>
REQUIRED. The Trust Anchor that the resolve endpoint
MUST use when resolving the metadata.
The value is an Entity identifier.
The value is an Entity Identifier.
<vspace blankLine="1"/>
The <spanx style="verb">trust_anchor</spanx> request parameter
MAY occur multiple times, in which case,
Expand Down Expand Up @@ -4335,7 +4335,7 @@ GET /resolve?
sub=https%3A%2F%2Fop.example.it%2Fspid&
entity_type=openid_provider&
trust_anchor=https%3A%2F%2Fswamid.se HTTP/1.1
Host: openid.sunet.se
Host: sunet.se
]]></artwork>
</figure>
</section>
Expand Down Expand Up @@ -4468,10 +4468,10 @@ Host: openid.sunet.se
</name>
<artwork><![CDATA[
{
"iss": "https://resolver.spid.gov.it/",
"sub": "https://op.example.it/spid/",
"iss": "https://resolver.spid.gov.it",
"sub": "https://op.example.it/spid",
"iat": 1516239022,
"exp": 1516298022,
"exp": 1516843822,
"metadata": {
"openid_provider": {
"contacts": ["legal@example.it", "technical@example.it"],
Expand Down Expand Up @@ -4514,12 +4514,12 @@ Host: openid.sunet.se
"eyJ0eXAiOiJ0cnVzdC1tYXJrK2p3dCIsImFsZyI6IlJTMjU2Iiwia2lkIjoiOH
hzdUtXaVZmd1NnSG9mMVRlNE9VZGN5NHE3ZEpyS2ZGUmxPNXhoSElhMCJ9.
eyJpc3MiOiJodHRwczovL3d3dy5hZ2lkLmdvdi5pdCIsInN1YiI6Imh0dHBzOi
8vb3AuZXhhbXBsZS5pdC9zcGlkLyIsImlhdCI6MTU3OTYyMTE2MCwidHJ1c3Rf
bWFya190eXBlIjoiaHR0cHM6Ly93d3cuc3BpZC5nb3YuaXQvY2VydGlmaWNhdG
lvbi9vcC8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vd3d3LmFnaWQuZ292Lml0L3Ro
ZW1lcy9jdXN0b20vYWdpZC9sb2dvLnN2ZyIsInJlZiI6Imh0dHBzOi8vZG9jcy
5pdGFsaWEuaXQvaXRhbGlhL3NwaWQvc3BpZC1yZWdvbGUtdGVjbmljaGUtb2lk
Yy9pdC9zdGFiaWxlL2luZGV4Lmh0bWwifQ.
8vb3AuZXhhbXBsZS5pdC9zcGlkIiwiaWF0IjoxNTc5NjIxMTYwLCJ0cnVzdF9t
YXJrX3R5cGUiOiJodHRwczovL3d3dy5zcGlkLmdvdi5pdC9jZXJ0aWZpY2F0aW
9uL29wLyIsImxvZ29fdXJpIjoiaHR0cHM6Ly93d3cuYWdpZC5nb3YuaXQvdGhl
bWVzL2N1c3RvbS9hZ2lkL2xvZ28uc3ZnIiwicmVmIjoiaHR0cHM6Ly9kb2NzLm
l0YWxpYS5pdC9pdGFsaWEvc3BpZC9zcGlkLXJlZ29sZS10ZWNuaWNoZS1vaWRj
L2l0L3N0YWJpbGUvaW5kZXguaHRtbCJ9.
xyz-PDQ_..."
}
],
Expand Down Expand Up @@ -5149,26 +5149,26 @@ Host: trust-anchor.example.com
<artwork><![CDATA[
{
"iss": "https://trust-anchor.federation.example.com",
"iat": 123972394272,
"iat": 1666335600,
"keys":
[
{
"kty": "RSA",
"n": "5s4qi ...",
"e": "AQAB",
"kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
"iat": 123972394872,
"exp": 123974395972
"iat": 1661151600,
"exp": 1677052800
},
{
"kty": "RSA",
"n": "ng5jr ...",
"e": "AQAB",
"kid": "8KnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMJJr",
"iat": 123972394872,
"exp": 123974394972,
"iat": 1647932400,
"exp": 1663830000,
"revoked": {
"revoked_at": 123972495172,
"revoked_at": 1661151600,
"reason": "compromised",
}
}
Expand Down Expand Up @@ -5556,15 +5556,15 @@ Content-Type: application/json
<figure>
<preamble>
In this example, the requesting party would make the following request to the Entity
<spanx style="verb">https://openid.sunet.se</spanx>
<spanx style="verb">https://op.sunet.se</spanx>
to obtain its Entity Configuration:
</preamble>
<name>
Request for Entity Configuration
</name>
<artwork><![CDATA[
GET /.well-known/openid-federation HTTP/1.1
Host: openid.sunet.se
Host: op.sunet.se
]]></artwork>
</figure>
</t>
Expand All @@ -5574,7 +5574,7 @@ Content-Type: application/json
<t>
The response is an Entity Configuration.
If the Entity is an Intermediate Entity or a Trust Anchor, the
response MUST contain metadata for a federation Entity
response MUST contain metadata for a Federation Entity
(<spanx style="verb">federation_entity</spanx>).
</t>
<t>
Expand All @@ -5593,26 +5593,61 @@ Content-Type: application/json
Intermediate Entity:
</preamble>
<name>
Entity Configuration Response JWT Claims Set
Entity Configuration Response JWT Claims Set for an Intermediate
</name>
<artwork><![CDATA[
{
"iss": "https://openid.sunet.se",
"sub": "https://openid.sunet.se",
"iss": "https://sunet.se",
"sub": "https://sunet.se",
"iat": 1516239022,
"exp": 1516298022,
"exp": 1516843822,
"metadata": {
"federation_entity": {
"contacts": ["ops@sunet.se"],
"federation_fetch_endpoint": "https://sunet.se/openid/fedapi",
"federation_fetch_endpoint": "https://sunet.se/fetch",
"organization_uri": "https://www.sunet.se",
"organization_name": "SUNET"
},
"jwks": {
"keys": [
{
"alg": "RS256",
"e": "AQAB",
"kid": "O-wFRGNsy0-4SR2jbXYwDHy6...",
"kty": "RSA",
"n": "Qo3n0N0Gv7L8T9I_2sAMc0I4...",
"use": "sig"
}
]
},
"authority_hints": [
"https://edugain.org"
]
}
]]></artwork>
</figure>
</t>
<t>
<figure>
<preamble>
The following is a non-normative example JWT Claims Set for a response from an
OpenID Provider Entity:
</preamble>
<name>
Entity Configuration Response JWT Claims Set for an OP
</name>
<artwork><![CDATA[
{
"iss": "https://op.sunet.se",
"sub": "https://op.sunet.se",
"iat": 1516239022,
"exp": 1516843822,
"metadata": {
"openid_provider": {
"issuer": "https://openid.sunet.se",
"signed_jwks_uri": "https://openid.sunet.se/jwks.jose",
"issuer": "https://op.sunet.se",
"signed_jwks_uri": "https://op.sunet.se/jwks.jose",
"authorization_endpoint":
"https://openid.sunet.se/authorization",
"https://op.sunet.se/authorization",
"client_registration_types_supported": [
"automatic",
"explicit"
Expand All @@ -5623,40 +5658,42 @@ Content-Type: application/json
"id_token_signing_alg_values_supported": [
"ES256", "RS256"
],
"contacts": ["ops@sunet.se"],
"organization_uri": "https://www.sunet.se",
"organization_name": "SUNET"
"logo_uri":
"https://www.umu.se/img/umu-logo-left-neg-SE.svg",
"https://www.sunet.se/sunet/images/32x32.png",
"op_policy_uri":
"https://www.umu.se/en/website/legal-information/",
"https://www.sunet.se/en/website/legal-information/",
"response_types_supported": [
"code"
],
"subject_types_supported": [
"pairwise",
"public"
],
"token_endpoint": "https://openid.sunet.se/token",
"token_endpoint": "https://op.sunet.se/token",
"federation_registration_endpoint":
"https://op.umu.se/openid/fedreg",
"https://op.sunet.se/fedreg",
"token_endpoint_auth_methods_supported": [
"private_key_jwt"
]

}
},
"jwks": {
"keys": [
{
"alg": "RS256",
"e": "AQAB",
"kid": "key1",
"kid": "yHozfrAd5G-pnmG4e1jCXpfc...",
"kty": "RSA",
"n": "pnXBOusEANuug6ewezb9J_...",
"n": "HIoSq4wkZiEkJDTPHiv7torK...",
"use": "sig"
}
]
},
"authority_hints": [
"https://edugain.org/federation"
"https://sunet.se"
]
}
]]></artwork>
Expand Down Expand Up @@ -6809,7 +6846,7 @@ Content-Type: application/json
<author fullname="Ken Whistler" initials="K." surname="Whistler">
</author>

<date day="12" month="August" year="2023" />
<date day="30" month="July" year="2025" />
</front>

<seriesInfo name="Unicode Standard Annex" value="15" />
Expand Down Expand Up @@ -6875,7 +6912,7 @@ Content-Type: application/json
</address>
</author>

<date day="19" month="January" year="2026"/>
<date day="20" month="January" year="2026"/>
</front>
</reference>

Expand Down Expand Up @@ -6931,7 +6968,7 @@ Content-Type: application/json
</address>
</author>

<date day="19" month="January" year="2026"/>
<date day="20" month="January" year="2026"/>
</front>
</reference>

Expand Down Expand Up @@ -7060,6 +7097,10 @@ Content-Type: application/json
Use the new specification name OpenID Federation for OpenID Connect 1.1,
which was previously named OpenID Connect Federation 1.1.
</t>
<t>
Merged in changes made to OpenID Federation 1.0 between
January 7 and January 19, 2026.
</t>
</list>
</t>

Expand Down
Loading