Implementing Federated Identity
1. Understanding Identity Federation Concepts
| Concept | Detail |
|---|---|
| Federation | Trust agreement between IdP and RP across domains |
| Trust anchor | Shared signing keys / metadata |
| Home realm | User's primary IdP |
| Discovery | "Where are you from?" page — finds user's IdP |
2. Implementing SAML Federation
| Element | Detail |
|---|---|
| Metadata exchange | Aggregated by federation operator (e.g., InCommon, eduGAIN) |
| Discovery | WAYF / SeamlessAccess |
| Attribute release | Per-SP scope (entity categories: R&S, CoCo) |
3. Implementing OAuth Federation
| Approach | Detail |
|---|---|
| OIDC Federation (RFC drafts) | Trust chains via JWTs |
| Hub model | Broker bridges multiple IdPs |
| Token exchange (RFC 8693) | Swap tokens across trust boundaries |
4. Using WS-Federation Protocol
| Aspect | Detail |
|---|---|
| Use | Legacy Microsoft (ADFS), SharePoint |
| Token format | SAML 1.1/2.0 or JWT |
| Endpoints | wsignin1.0, wsignout1.0 |
| Status | Maintained, but new projects use OIDC/SAML |
5. Implementing Trust Relationships
| Mechanism | Detail |
|---|---|
| Direct trust | Bilateral metadata exchange |
| Federation trust | Common trust anchor (signed metadata bundle) |
| Brokered trust | Hub IdP trusted by all parties |
| Renewal | Key rollover with overlap window |
6. Handling Identity Mapping
| Strategy | Detail |
|---|---|
| Persistent ID | Stable opaque ID per (IdP, SP) pair |
| Transient ID | Single-session only (privacy) |
| Email-based | Risky if multiple IdPs control same email |
| Account linking | Multiple external IDs → one local user |
7. Implementing Attribute Aggregation
| Source | Use |
|---|---|
| Primary IdP | Identity claims |
| Attribute authority | Roles/entitlements from separate service |
| VOOT / SCIM | Group memberships |
| Risk engine | Real-time risk signals |
8. Using Federation Metadata
| Format | Detail |
|---|---|
| SAML | EntitiesDescriptor XML, signed |
| OIDC | Federation Entity Statements (JWT) |
| Refresh | Periodic (daily) with signature verification |
| Failure | Use cached version, alert |
9. Implementing Federation Logout
| Aspect | Detail |
|---|---|
| Single Logout | Cascade via SAML SLO or OIDC back-channel |
| Reliability | Best-effort; some RPs may stay logged in |
| User feedback | Show "you remain signed in to X, Y" if cascade incomplete |
10. Handling Federation Errors
| Error | Handling |
|---|---|
| Metadata signature invalid | Reject, alert ops |
| Trust expired | Block until renewed |
| Attribute missing | Fall back to defaults or deny |
| Discovery timeout | Prompt user to choose IdP manually |