Difference between revisions of "OpenID Connect"
From MgmtWiki
(→Problems) |
(→References) |
||
| Line 21: | Line 21: | ||
==References== | ==References== | ||
#OpenID specifications (use this if you want to be sure you have the latest version): http://openid.net/developers/specs/ | #OpenID specifications (use this if you want to be sure you have the latest version): http://openid.net/developers/specs/ | ||
| − | #OpenID connect core specification (2014-11-08): http://openid.net/specs/openid-connect-core-1_0.html | + | #OpenID connect core specification with Errata Set 1 (2014-11-08): http://openid.net/specs/openid-connect-core-1_0.html |
[[Category:Glossary]] | [[Category:Glossary]] | ||
[[Category:Standard]] | [[Category:Standard]] | ||
Revision as of 21:42, 19 August 2018
Full Title or Meme
An extension of OAuth 2.0 to give a Relying Party access to User Information. (Other uses of this protocol are possible, but not of interest for Identity Management.
Context
- The OAuth 2.0 protocol gave access to User Resources, but without authentication, it was fraught with may vulnerabilities.
- The OpenID Connect protocol is always among three parties: the User (called subject), the Relying Party (called client for OAuth compatibility) and the Identifier or Attribute Provider (called OpenID Provider).
- There are always three Identifiers: the subject id (sub), the client id (client_id), and a URL pointing to a set of configuration parameters of the OpenID Provider (OP).
Problems
These are issues that the OpenID Connect core specification leaves up the the implementer to chose that create Security or Privacy problems.
- The Subject ID may be ephemeral. << verify
- The Subject ID (sub) may be shared among all of the clients that use the same OP unless pair-wise sub is included in the meta-data.
- The Identifier or Attribute Provider may optionally ask for User Consent and may provide any set of claims they deem appropriate.
Solutions
These are additional limitations that need to be provided to the OpenID Connect implementation to meet existing legislation for the 3 party problem.
- The Subject ID must be persistent and not used for different users for at least one year after it use is no longer used for its original Subject.
- The Subject ID must not be shared with different clients by implementing pair-wise identifiers in the OP.
- The Identifier or Attribute Provider must not provide any claims to the Relying Party that have not been part of an User Consent approval process.
References
- OpenID specifications (use this if you want to be sure you have the latest version): http://openid.net/developers/specs/
- OpenID connect core specification with Errata Set 1 (2014-11-08): http://openid.net/specs/openid-connect-core-1_0.html
