Page History

...

• Define the Endpoint: The endpoint is defined under the following path: /.well-known/openid-federation
• Implementation: Ensure this endpoint serves the entity’s entity Configuration.

Shortened Shortened example of an entity Configuration:

...

• Add to Configuration: Add authority_hints in your entity’s metadata configuration

Registering the Entity as a Subordinate Entity

...

{
  "<entity-identifier>": {
    "entity_types": [
      "federation_entity",
      "<additional-entity-types>"
    ],
    "jwks": {
      "keys": [
        {
          "kty": "RSA",
          "use": "sig",
          "kid": "example-kid",
          "n": "example-n-value",
          "e": "AQAB"
        }
      ]
    }
  }
}

Instructions

• Replace <entity-identifier> with the entity_id of your entity (typically its HTTPS URL).

• Every entity must include federation_entity as one of its types.

• Add the entity types that apply to your role in the Sandbox:

  • openid_relying_party for RPs.
  • openid_provider for OPs.
  • oauth_authorization_server for entities acting as OAuth 2.0 AS.

• Place your public keys in the "jwks" section. Only public key parameters are included. Private key material must never be published.

...

This registration document can then should be submitted to the Sandbox operator to complete onboarding of the entity.

...

Testing the Trust Relationships

1. Validate trust marks
   Use tools like jwt.io to decode and verify trust marks using the Trust Anchor's public keys.

2. Retrieve metadata
   Ensure the the .well-known/openid-federation endpoint correctly serves the entity’s entity configuration:

   Code Block
   language bash
   curl -X GET https://your-entity.example.com/.well-known/openid-federation

3. Check authority hints
   Verify that authority_hints points to the correct Superior

4. Validate public keys
   Confirm that the Trust Anchor’s public keys match those provided in your local configuration.

...