759 VIEWS
Pinterest LinkedIn LINE

Today, from 4 thirty to 8 in the morning Japan time, an OpenID Foundation workshop was held at the Google campus in California. Video and slides are expected to be released soon, but here is a quick report first.

Table of Contents

Overview by Gail Hodges, Executive Director of the OpenID Foundation

Gail Hodges presented the OpenID Foundation’s major accomplishments over the past 6 months:

Specification progress:

  • FAPI 2 Security Profile and Attacker Model were finalized
  • FAPI 1 was submitted to ISO as a Publicly Available Specification
  • FAPI 2 conformance tests now support DPoP
  • Progress in the DCP (Digital Credentials Protocol) Working Group: OpenID for Verifiable Presentations reached Implementer’s Draft 3, OpenID for VCI reached Implementer’s Draft 2, and the HAIP Profile reached Implementer’s Draft 1.
  • In eKYC (Electronic Know Your Customer) and IDA (Identity Assurance), the OpenID Connect Authority specification reached 1.0, while AuthZen advanced in November 2024 to version 1.0.

Events and collaboration:

  • 4 different working groups conducted interoperability tests
  • Shared Signals: interoperability events in Texas and London
  • DCP Working Group: a hackathon in California and a MOSIP event in the Philippines
  • Collaboration with NIST: a small-scale interoperability test under the NCCoE program
  • AuthZen: its first interoperability event at Gartner, with strong participation
  • Federation: a SUNet-hosted event in Sweden, planned for the week of April 24.

Governance and operational progress:

  • Finalized the process document and IPR agreement, the first update in about 7 years
  • Mark Haine developed a tool to automate specification checks

Thought leadership:

  • Established the Australian Digital Trust Community Group
  • SIDI Hub: Elizabeth Garber published 9 reports
  • Government feedback: briefed the Federal Reserve Bank of New York and provided feedback on NIST directives and NIST attribute services
  • Participated in the Aspen Institute’s fraud task force
  • A blog post by Dima offered concrete recommendations on using fine-grained authorization and rich authorization requests

Media exposure:

  • Promoted Foundation activities and events
  • Co-chairs and editors were active on blogs and podcasts
  • Okta’s recognition of identity leaders: Foundation members and partners accounted for more than half of the 25 people recognized

eKYC (Electronic Know Your Customer) and IDA (Identity Assurance) Working Group update

Presentation by Hodari:

  • OpenID Connect Authority 1.0 adoption is spreading worldwide, particularly in Australia and the United Kingdom
  • The specification was submitted to ISO (International Organization for Standardization) as a Publicly Available Specification, and its 12-week voting period is nearly over
  • A new working group call for Identity Assurance starts at 5:30 Tokyo time
  • The conformance test suite has graduated from beta
  • The next phase is expected to include age-assurance and authority use cases
  • Q2 2025: attachments are expected to be finalized, and the Authority specification is expected to reach Implementer’s Draft 2.

DADE (Death and Digital Estate) Community Group

Presentation by Dean Sachs:

  • September 2024 saw the establishment of a group intended to improve understanding of how individuals can manage their digital estates
  • A digital estate includes online writings, images, photographs, audio, video, code, and other digital data
  • Use cases are being developed for temporary or permanent incapacity and death
  • The group is gathering data about legacy contacts and service mechanisms, which vary greatly across platforms
  • Discussions involving death can be difficult across cultures and languages
  • Identiverse 2025 will feature a DADE panel
  • A white paper titled “The State of Digital Estate Management” is being planned and will include a planning guide
  • Publication is planned for Cybersecurity Awareness Month
  • Regular working group calls are held for North America/EMEA and APAC/North America

Q&A:

  • In response to whether the effort is global or region-specific: ideally it is global, but work is needed at the regional level. A group is taking shape in Australia
  • On collaboration with MOSIP: the group wants to draw on knowledge from regions where MOSIP is active, including India and Africa
  • It was noted that accessing a service on behalf of a deceased person can sometimes become a convenient anti-pattern

Panel discussion on AI authentication

Moderator: Tobin, a researcher affiliated with MIT and Stanford. Panelists: Aaron Parecki, board member; George Fletcher, board member; and Dima Postnikov, vice-chair

Introduction by Tobin:

  • The AI community has discovered that chatbots can connect to APIs and take actions, and is currently trying to do so without authentication
  • Startups and AI companies are recognizing the need for more robust authentication and authorization, but are trying to build them from scratch
  • The OpenID Foundation is well positioned to take a clear stance so the AI community does not reinvent the wheel

Summary of a recent blog post by Aaron Parecki:

  • The Model Context Protocol (MCP) seeks to standardize access to AI tools, but has problems on the authentication side
  • Applying established OAuth concepts can solve most of these problems
  • The AI world tends to build entirely new things, but many existing API-usage and authorization patterns map directly

Additional comments by Tobin:

  • A Stanford workshop revealed differing views on delegated authentication for agents
  • OpenAI argued that consumers should simply be able to “have a robot perform a task”
  • Others want to place strict limits on what AI can do
  • The role of human intervention and the ways OpenID-style tools can help must be considered

Views from George Fletcher:

  • Accountability is a key issue
  • More user consent shifts responsibility to the user, but degrades the user experience
  • There are complex authorization questions about how much authority to delegate to an agent, such as the permitted use of credit-card information

Panel discussion:

  • Discussion covered delegated authority, expression of intent, and scope limits
  • Differences between AI and ordinary use cases include unexpected actions, expression of intent, and agents that learn
  • It is important to build on existing infrastructure
  • Existing OAuth mechanisms could be extended

In closing:

  • The OpenID Foundation needs to provide the AI community with a forum in which to speak up
  • A white paper is being planned
  • We should draw on knowledge from areas where solutions already exist, such as open banking and digital ID credentials

OpenID Connect Working Group update

Presentation by Mike Jones:

Key progress:

  • A security analysis of OpenID Federation was completed and found a significant security hole
  • The certification team is developing certification tests for OpenID Federation
  • A Federation interoperability event is planned at SUNet in Sweden at the end of April.

Newly adopted specifications:

  • OpenID Federation Wallet Architectures draft
  • OpenID Connect RP Metadata Choices specification
  • OpenID Provider Commands specification, discussed later by Dick Hardt

Security analysis and response:

  • A Federation security analysis by the University of Stuttgart found a bug or ambiguity involving the audience value sent to the authorization server
  • Vulnerable deployments were discussed privately for several months and fixed
  • Fixes were made to OpenID Federation, OpenID Connect Core (errata draft), FAPI 2、FAPI 1 (errata draft), CIBA Core (errata draft), and others
  • To cover the OAuth specification as well, a draft called 7523bis was adopted

Work in progress:

  • Planning a Federation interoperability event with about 25 participants and about 12 implementations
  • Considering a review of RP Metadata Choices for Implementer’s Draft status
  • Assessing the status of 3 dormant specifications: OpenID Connect Claims Aggregation, User Info Verifiable Credentials, and Self-issued OpenID Provider V.2) are being assessed

EAP (Enhanced Authentication Profile) Working Group:

  • Updated the OpenID Connect EAP ACR Values specification
  • Registered ACR values for phishing-resistant authentication and phishing-resistant hardware-protected authentication in the official registry
  • The working group final call was due to end the following day

OpenID Provider Commands

Presentation by Dick Hardt:

  • A simple concept in which an OP sends commands to an RP
  • Commands are JWTs signed by the OP, and the RP can validate the signature just as it does for an ID token
  • Supports every account-lifecycle stage defined by ISO: activate, maintain, suspend, archive, reactivate, restore, and delete an account
  • Also supports tenant-level commands, including metadata, audit, suspend, archive, and delete tenant commands
  • Uses Server-Sent Events to address the challenge of long responses
  • Aims to lower the adoption barrier compared with SCIM (System for Cross-domain Identity Management)

Q&A:

  • Current issues include a few small changes, such as a proposal to rename the command URI to command endpoint
  • Implementation feedback has led to improvements such as adding error events

AuthZen (Authorization) Working Group update

Presentation by Omri Gazitt, participating remotely:

  • 2023 saw the establishment of a working group aiming to standardize communication between policy enforcement points and policy decision points
  • November 2024 saw publication of the first core API draft, the Evaluation API; January 2025 brought the Evaluations API; and March brought a draft Search API
  • Gartner IAM 2024 London interoperability event initiated work on an API gateway profile

Interoperability testing:

  • Tested 2 policy enforcement points: an API gateway for medium-grained authorization and an application for fine-grained authorization
  • December 2024 to March 2025, the number of participating vendors increased substantially
  • The number of PDP vendors implementing AuthZen grew to 17 vendors
  • API gateway vendors numbered 7 new API gateway vendors joined, including Amazon API Gateway, Broadcom’s L7 Gateway, Envoy, and Kong

Roadmap:

  • The Evaluation API and Evaluations API are stable, with no changes planned
  • Move toward Implementer’s Draft 2, covering the Search API, partial evaluation, and discovery
  • 2025Target AuthZen 1.0 Final in summer or fall
  • 2025 initiatives: formalize the API gateway profile, deliver events to stateful PDPs using Shared Signals, and explore an IDP profile
  • Commercial implementations: Topaz supports native AuthZen endpoints, Zuplo supports AuthZen natively, and Amazon Cedar plans AuthZen support in the second half of 2025 will add AuthZen support in the second half

IPSIE（Interoperability Profiles for Secure Identity in the Enterprise）

Presentation by Dean Sachs and Aaron Parecki:

  • A working group addressing interoperability and security challenges in enterprise identity
  • October 2024 saw the group’s establishment amid the challenge of many standards and many options within each standard
  • The goal is to define profiles using existing standards and reduce optionality and ambiguity
  • A level-based approach reflecting enterprise maturity: the Session Lifecycle track (SL) and Identity Lifecycle track (IL), each with 3 levels
  • An OpenID Connect profile has been proposed as the initial draft and is in an open call for adoption
  • Another contributed draft explains how to use SAML to meet the goals of SL1 objectives
  • Work has also begun on a draft covering the identity provisioning lifecycle
  • December 2025 Gartner IAM targets an SL1 interoperability event

Q&A:

  • On the Application and Identity Services columns: Identity Services means everything that manages identities operated by an enterprise, including IDPs and threat-monitoring services

Shared Signals Framework

Presentation by Atul:

Overview:

  • A framework for delivering information asynchronously and reliably between cooperating parties
  • Provides a framework for negotiating what information is exchanged and about whom
  • Provides controls to start, stop, pause, and resume a stream
  • Includes application profiles for Risk, covering account security, and CAEP, covering session management
  • SCIM Events is a draft for communicating account-management changes

Architecture:

  • The receiver initiates communication and tells the transmitter which events it wants to receive
  • Actual events are sent as JWTs over asynchronous transport
  • Uses JWTs with a specific structure called Security Event Tokens (SETs)

Specification progress:

  • After several issues are resolved, 3 specifications, Shared Signals Framework Core, CAEP, and RISC, are expected to advance to Final status
  • The group is addressing implementation-feedback issues and questions about how to organize the specifications

Interoperability testing:

  • December 2024 featured testing with many participating vendors
  • March 2025 allowed transmitters to participate only after passing conformance tests
  • The level of interoperability testing is being raised gradually, with the 3rd event being more rigorous

Adoption:

  • Apple, Okta, Signal, Jamf, and others support SSF in production products
  • Announcements of betas and implementation plans are also increasing
  • A white paper for financial services is in preparation
  • Work with the Aspen Institute on the potential of shared signals in combating fraud

Modrna（Mobile Operator Discovery, Registration & autheNticAtion）

Presentation by Bjorn Hjelm:

Latest working group status:

  • The CIBA Core specification has reached Final status
  • Working group final calls are expected to be completed for the Discovery Profile and Modrna CIBA Profile
  • Errata work is under way for CIBA Core
  • Outreach to the GSMA community, the mobile network operator industry association, ETSI, and the CAMARA project at the Linux Foundation
    • CAMARA: Identity and Consent Management SP, KnwoYourCustomer SP
  • Working toward a liaison agreement with GSMA

Plans:

  • Q3 will bring Errata 2, with a GSMA agreement targeted by year-end

Submission to the ITU (International Telecommunication Union)

Continuation by Bjorn Hjelm:

  • The ITU is part of the United Nations and, like ISO, is a formal standards body
  • Some governments require specifications from a formal standards body such as ISO or ITU
  • The effort seeks ITU adoption of OpenID specifications so that they can be implemented in more regions
  • ISO used adoption by reference, publishing the specification unchanged under an ISO cover sheet, whereas ITU requires adoption by transposition, reformatting the specification into ITU format
  • The OpenID Connect Core specification was converted to ITU format and submitted for review
  • Feedback is expected at a meeting the following week
  • Rather than submitting all specifications at once, the process is first being tested with 1 specification

SIDI Hub

Presentation by Elizabeth Garber:

Overview and principles:

  • A global multistakeholder community collaborating on the requirements for global interoperability of digital identity
  • 25 or more countries participate, alongside intergovernmental organizations such as the OECD and World Bank
  • 5 continents and 5 summits: Paris, Cape Town, Berlin, Washington, D.C., and most recently Tokyo
  • The next event is May 2025 in Addis Ababa at ID for Africa
  • Grounded in human centricity, domestic sovereignty, multilateral cooperation, and real use cases, with attention to both technology and policy

2024 achievements:

  • 9 reports were published: a report after each event and 3 champion use cases involving refugees, education and educational credentials, and opening bank accounts
  • A report on governance of the global credential ecosystem
  • The annual report sets short-, medium-, and long-term goals

Current activities:

  • Building a “digital commons”: an open suite of policy, technology, and other tools
  • Technical workstream: focuses on trust management and analyzes existing models such as OpenID Federation, LUCI’s work, and TRAIN
  • Trust Framework workstream: expanding analysis by the Open Identity Exchange and seeking bridges across national ecosystems
  • Examining trust frameworks in contexts such as the Financial Action Task Force (FATF)
  • An approach to Europe’s proof rulebook

FAPI update

Presentation by Joseph Heenan:

Key progress:

  • FAPI 2 Security Profile and Attacker Model were published as Final Specifications
  • Conformance tests are in development, with a beta release planned during April 2025.
  • Ecosystem growth: BIS projects, the UK’s SelectID, and consideration of the grant-management specification in Chile and Colombia
  • Continued engagement with the Australian government
  • FDX is migrating to FAPI 2.

FAPI 2 saw these key changes from Implementer’s Draft to Final:

  • A change to the audience value for private-key JWT client authentication, addressing a security vulnerability
  • Implementation migration is expected to be relatively easy

Future work:

  • FAPI 2 Message Signing specification is being advanced to Final
  • Focus on implementation and deployment advice documents
  • Planning a shared-signals white paper for regions interested in financial services, including Chile and Brazil

DCP (Digital Credentials Protocol) update

Continuation by Joseph Heenan:

Recent Implementer’s Draft releases:

  1. OpenID for Verifiable Presentations (VP) Implementer’s Draft 3:
    • Added the Digital Credentials Query Language (DCQL, pronounced “duckle”)
    • Added transaction data, embedding data confirmed by the user
    • Added an SD-JWT profile and X.509 authentication method
    • Changed how the client ID is passed in presentation exchange, resolving a security issue
    • Added an appendix for the browser Digital Credentials API
  2. OpenID for Verifiable Credential Issuance (VCI) Implementer’s Draft 2:
    • Implemented a Nonce endpoint to resolve the multiple-user-interaction issue
    • Improved unlinkability through batch issuance of the same credential
    • Removed the Batch Endpoint to reduce complexity
  3. High Assurance Interoperability Profile (HAIP) Implementer’s Draft 1:
    • Includes an mdoc presentation profile for the browser Digital Credentials API
    • ISO/IEC 18013-7 alignment
    • Mandates use of DCQL

Current work:

  • Removing presentation exchange entirely from OpenID for VP and consolidating on DCQL
  • Support for Trusted Authorities
  • Addressing challenges in multi-RP authentication

Conformance testing:

  • Developing alpha tests for Verifiable Credential Issuance, focused on SD-JWT
  • Updating wallet tests for Verifiable Presentations to support Implementer’s Draft 3.
  • Adding verifier tests for Verifiable Presentations

Collaboration:

  • Working closely with the European Commission so that OpenID specifications are explicitly referenced in the next revision of EU implementing acts

NIST NCCoE (National Cybersecurity Center of Excellence) interoperability testing

Presentation by Juliana of Microsoft:

Event background:

  • Part of NIST’s National Cybersecurity Center of Excellence project
  • An initiative involving mobile driver’s licenses and digital IDs
  • Use cases for opening bank accounts and periodic access at a high assurance level

Test overview:

  • Testing used multiple wallets, multiple browsers, multiple operating systems, and a single verifier, Mattr
  • Tested the ISO mDL Annex C profile and 4 different OpenID for VP configurations
  • Built an architecture that enables remote interoperability testing

Results:

  • April 4, 2025 achieved an approximately 87% success rate
  • For mdoc, among 80 tested pairs, 1 unsigned cases and 8 signed cases failed
  • For SD-JWT, 27 pairs passed and 1 pair failed
  • Some known gaps were reportedly resolved over the weekend
  • No significant feedback concerned the protocol itself

Next steps:

  • April 25 and May 5 saw additional testing
  • May 5 featured a detailed morning demonstration for SDOs and government stakeholders, followed by a public webinar in the afternoon

Conformance and certification program update

Final presentation by Joseph Heenan:

Test development for multiple specifications:

  • FAPI: DPoP support is available, with FAPI 2 Final tests due to enter beta soon
  • Federation: beta tests are available, and tests supporting automated registration flows are being developed for the interoperability event
  • eKYC: tests are being upgraded, and details of the certification program are under consideration
  • Shared Signals: transmitter tests are available, and receiver testing has also begun
  • Verifiable Credentials: VP tests were used at the interoperability test, with VCI tests coming soon

Coordination with the European Commission:

  • Ongoing discussions about potential uses of the tests

Closing

All participants took a commemorative photograph, and the workshop concluded. Board members were reminded that another 2 hours of meetings awaited them.

The recording of the full workshop is available below.

Watch this video on YouTube.
Playing the video connects to YouTube.

Related posts

A Christmas Present from the OpenID Foundation

And so, here is a Christmas present for everyone from the OpenID AB+Connect WG. As of today, the OpenID Connect specifications have entered an Implementer's Draft…

Identity · 2011-12-24