SPID/CIE OIDC Federation

This testbed is based on the Italian federation implementation: https://github.com/italia/spid-cie-oidc-django.

It consists of the following entities:

• a trust anchor → https://trust-anchor.testbed.oidcfed.incubator.geant.org/
  • embedded OP (SPID) → https://trust-anchor.testbed.oidcfed.incubator.geant.org/oidc/op/ 
    metadata: https://trust-anchor.testbed.oidcfed.incubator.geant.org/oidc/op/.well-known/openid-federation?format=json
  • embedded RP → https://trust-anchor.testbed.oidcfed.incubator.geant.org/oidc/rp/
    metadata: https://trust-anchor.testbed.oidcfed.incubator.geant.org/oidc/rp/.well-known/openid-federation?format=json
• an RP → https://relying-party.testbed.oidcfed.incubator.geant.org/
  metadata: https://relying-party.testbed.oidcfed.incubator.geant.org/.well-known/openid-federation?format=json
• an OP (CIE) → https://cie-provider.testbed.oidcfed.incubator.geant.org/
  metadata:
• a PHP RP → https://relying-party-php.testbed.oidcfed.incubator.geant.org/
  metadata: https://relying-party-php.testbed.oidcfed.incubator.geant.org/.well-known/openid-federation?format=json

The RP implemented in PHP is based on the implementation from https://github.com/italia/spid-cie-oidc-php.

Fedservice example

Repo: https://gitlab.geant.org/TI_Incubator/oidcfed/fedservice

This testbed is based on the example implementation from https://github.com/rohe/fedservice.

It consists of the following entities:

• two trust anchors
  • SEID → https://seid.fedservice.testbed.oidcfed.incubator.geant.org
  • SWAMID → https://swamid.fedservice.testbed.oidcfed.incubator.geant.org
• two intermediate federation entities:
  • LU → https://lu.fedservice.testbed.oidcfed.incubator.geant.org
  • UMU → https://umu.fedservice.testbed.oidcfed.incubator.geant.org
• two RPs
  • RPa (with automatic registration) → https://auto.fedservice.testbed.oidcfed.incubator.geant.org
  • RPe (with explicit registration) → https://expl.fedservice.testbed.oidcfed.incubator.geant.org
• an OP
  • OP → https://op.fedservice.testbed.oidcfed.incubator.geant.org

The trust relationships are depicted below.

 Inter-federation logins

Establishing trust between entities from different federations is possible if a valid trust can be constructed between the two entities.

In the existing testbeds, the trust anchor in the Italian federation was added as a trust anchor for the OP in Roland's example federation, making it possible that all RPs in the Italian federation could authenticate users from OP.