Versions Compared

Old Version 24

changes.mady.by.user Stefan Halen

Saved on

compared with

New Version Current

changes.mady.by.user Stefan Halen

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Trust Anchor: Root of trust. Defines policies and signs metadata.

Resolver: Provides trust chain resolution services, enabling entities to validate metadata against the Trust Anchor.Intermediate: Manages subordinate entities and aggregates metadataBuilds and returns validated trust chains by following authority hints and subordinate statements, allowing entities to establish trust with a Trust Anchor.

Trust Mark Issuer: Issues signed Trust Marks certifying compliance with federation requirements.

Intermediate: Manages subordinate entities and aggregates metadata.

OpenID Provider: Authenticates users and issues tokens under federation policies.

...

  • curl -s: fetches the JWT, -s silences progress.

  • cut -d '.' -f2: extracts the payload from the JWT (middle part).

  • tr '_-' '/+': translates Base64URL alphabet into standard Base64.

  • base64 -d: decodes the payload.

  • jq .: pretty-prints the JSON.

Nodes

The following base nodes are available in operated by the federation operator and form the core of the Swefed OIDF Sandbox. These nodes provide the trust anchor, resolution services, and supporting infrastructure.

Additional nodes such as OpenID Providers (OPs), Relying Parties (RPs), and further intermediates are contributed and managed by Sandbox participants.

Trust Anchor

  • URL: https://trust-anchor.oidf.swefed.se
  • Role: Root of trust. Publishes federation policies and signing keys.
  • Provides federation endpoints: fetch, list, resolve.

...

  • All nodes expose their Entity Configuration at /.well-known/openid-federation.
  • Trust chains must always be validated against the Trust Anchor.
  • JWT signatures must be verified with the published keys from trusted entities.
  • Trust Marks must be validated against with the Trust Mark Issuer’s published metadatakeys, provided the issuer’s trust chain resolves to the Trust Anchor.

Entity Integration

This section explains how to connect an entity to the Swefed Sandbox Trust Infrastructure. It covers metadata exposure, configuration of trust anchors, authority hints, and trust marks.

...

  • Entity ID (URL): https://trust-anchor.oidf.swefed.se

  • Public Keys (JWKS):

    Code Block
    languagejs
    {
    "keys": [
        {
            "kty": "RSA",
            "use": "sig",
            "kid": "d2ZPZDVKa0Z4N1J4LTB2VWM1VFFhTUdSdnU3czZKQzhwc1F1U3ZHWEV3SQJI0SzIoDD4gaEzmLUgKGj-eu5jkTpEHW1JKk7OGdyiQ",
            "en": "AQABjSDBu2-S3Z2-HN2ToJv3zQWe0lizg2VNq4Y68Xy1513nAv1fa9p1Sw5YRyhWUxCUnWnNCmGS5g11-Npqco8A7XUGzroYgOmD_1Pv0xBhOFpVQDwzLs7vmyaH2GiHDrUGBHVUJrdpjMsT5YD3xw39hQLDVlZ9qZeS4U0jUhGR4qoF5f4KuFxSb6OykDRvMcP2jSf6fvLw5oKg5b16LqLcAB-LVLC43QRXDRj1zAUMuuBa4n_dwyRG0aF2FsNsLnwvWLVGTrcSuwdnagl_T8oLLE_X5HtWQyOn0dmS_zbVZnkzxxso9usuMD4f-7BDTZq5kWRa-HUBqjpEOOcEp-ix-Q",
            "ne": "lzLK1jAEMh4duP6Ym_pHWXYJZkJ-LuJvPHqIuQrxZnEhB4ODpA0hfj9g2UdBBVzbZdhOXKg9ObTQhG_TTISDliyjKAphxF5EObMpPtCoy_ImZ262zRdK4nii6AGVuABd5777GEBIwb-zZncWypjCX-1T6CBVECi4DnoHGDHDWhBTcIa9DE6ZDAjAgrKeiDz96gOL3BrGTYHDkjIpp__FP9dZJXJjgDV2n0cvC_MDmp8N8C-Rc1vd63lpmoXxvIqBy8bSM8jXSDxPTNkcJdlducNo9sR9j-7TsGdgE9PNK-iVzyp67QnmokreMCHx3NExkmi-MfkHrPAHwE_OneNVhwAQAB"
        },
        {
            "kty": "EC",
            "use": "sig",
            "kid": "R180Y3dtOWY2TzVoU3NYT1I2OUcyay0waWdVYVJ2YkFQZmRqaDBJZHZPMApj4FG-prDKHyUrliyQb55zFOG3jwu_ivRPWnlB9YgKc",
            "crv": "P-256",
            "x": "OSKZj-f9PT5UKWHiQ-VdhY-gfh0h-dA_weaYFqfkuUgXO0BmxPvPM7kfkfXwpXWOpF8Zm_-xwe_lfz6NWz4dxA",
            "y": "4y8u3C-CMWySQFMHN0tvafgwKWbDLS5XSQEo83HupyYtXrhZ592sNhS1h3J79_d9kB-nphMLSUkegJ99ak1s-4"
        }
    ]
}


Authority Hints

The authority_hints parameter specifies the URL of the Intermediate Entities or Trust Anchors that are Immediate Superiors of the entity. This helps other Trust Infrastructure participants understand upstream trust relationships.

...

The following Trust Marks are available for issuance:

  • Sambi:

      ...

        • ID: https://trust-mark.oidf.swefed.se/sambi
      Retrieving Trust Marks

      Trust Marks will be supplied on request.

      1. Inputs to Trust Mark Issuer operator:
        • id: The identifier for the Trust Mark.
        • sub: The entity's entity Identifier.
      2. Steps:
        • Supply the id and sub to the Trust Mark Issuer.
        • Retrieve the issued Trust Mark as a signed JWT.
      3. Include in Metadata: Add issued Trust Marks to your entity’s metadata:

      ...

      1. configuration:
      Testing Trust Marks
      1. Decode JWT: Use tools like jwt.io to inspect the Trust Mark's claims and ensure all required fields are present.
      2. Verify Signature: Validate the JWT signature against the Trust Mark Issuer's public key.
      3. Check Expiration: Ensure the exp claim (if present) has not expired.
      4. Validate References: Follow the ref URL (if provided) to confirm compliance with human-readable policy documents.

      ...