search

openid / federation

4 stars 3 forks source link

Align .well-known treatment with OpenID Connect #36

Closed selfissued closed 3 weeks ago

selfissued commented 1 month ago

The specification describes two options for creating the URL from which the Entity Configuration is retrieved. Using the Entity Identifier https://multi-tenant-service.example.com/my-tenant-identifier as an example, these are:

  1. Insert /.well-known/openid-federation between the host and the path of the Entity Identifier, resulting in https://multi-tenant-service.example.com/.well-known/openid-federation/my-tenant-identifier. This parallels the .well-known treatment at https://www.rfc-editor.org/rfc/rfc8414.html#section-3.
  2. Concatenate /.well-known/openid-federation to the Entity Identifier, resulting in https://multi-tenant-service.example.com/my-tenant-identifier/.well-known/openid-federation. This parallels the .well-known treatment in https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig.

As the spec says:

Of course, in real multi-tenant deployments, in which the Entity Identifier might be of the form https://multi-tenant-service.example.com/my-tenant-identifier the tenant is very likely to not have control over the path https://multi-tenant-service.example.com/.well-known/openid-federation/my-tenant-identifier whereas it is very likely to have control over the path https://multi-tenant-service.example.com/my-tenant-identifier/.well-known/openid-federation.

Pragmatically, deployability and interoperability and will be increased by selecting the OpenID Connect treatment over the OAuth treatment.