https://github.com/impierce/openid-federation
A Rust implementation of the OpenID Federation 1.0 standard.
https://github.com/impierce/openid-federation
Last synced: 10 days ago
JSON representation
A Rust implementation of the OpenID Federation 1.0 standard.
- Host: GitHub
- URL: https://github.com/impierce/openid-federation
- Owner: impierce
- Created: 2025-10-02T13:12:42.000Z (10 months ago)
- Default Branch: dev
- Last Pushed: 2025-10-02T14:28:59.000Z (10 months ago)
- Last Synced: 2025-10-02T14:39:35.603Z (10 months ago)
- Language: Rust
- Size: 1.95 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# OpenID Federation
A Rust implementation of the OpenID Federation 1.0 standard.
This library provides comprehensive support for OpenID Federation, enabling the creation of trust relationships between OpenID Connect providers and relying parties through a federation of trust anchors.
## Features
- **Subordinate Statements and Entity Configurations**: Create and validate federation subordinate statements and entity configurations
- **Trust Chain Management**: Build and validate trust chains for federation entities
- **JWT Processing**: Sign and verify JWTs with federation-specific extensions
- **Metadata Handling**: Support for all entity types (Federation Entity, OpenID Provider, Relying Party, etc.)
- **Policy Operators**: Implementation of federation metadata policy operators
- **HTTP Client**: Built-in client for fetching entity configurations and statements
- **Comprehensive Validation**: Full validation of subordinate statements, entity configurations, trust chains, and metadata
## Quick Start
Add this to your `Cargo.toml`:
```toml
[dependencies]
openid-federation = "0.1.0"
```
### Basic Usage
```rust
use openid_federation::{
EntityConfiguration, SubordinateStatement, JwkSet, FederationEntityMetadata,
EntityMetadata, TrustChain
};
use chrono::{Duration, Utc};
use url::Url;
// Create an entity configuration
let entity_id = Url::parse("https://example.com")?;
let jwks = JwkSet::new();
let exp = Utc::now() + Duration::hours(24);
let iat = Utc::now();
let mut config = EntityConfiguration::new(entity_id, jwks, exp, iat);
// Add metadata
let mut metadata = EntityMetadata::new();
metadata.federation_entity = Some(FederationEntityMetadata {
organization_name: Some("Example Organization".to_string()),
homepage_uri: Some(Url::parse("https://example.com")?),
..Default::default()
});
config = config.with_metadata(metadata);
// Create and validate trust chains
let trust_chain = TrustChain::try_new(vec![
"entity_config_jwt".to_string(),
"intermediate_statement_jwt".to_string(),
"trust_anchor_config_jwt".to_string(),
]);
```
### HTTP Client Usage
```rust
use openid_federation::{FederationClient, UrlValidator};
use url::Url;
#[tokio::main]
async fn main() -> Result<(), Box> {
let client = FederationClient::new();
let entity_id = Url::parse("https://example.com")?;
// Validate entity ID
UrlValidator::validate_entity_id(&entity_id)?;
// Fetch entity configuration
let config_jwt = client.fetch_entity_configuration(&entity_id).await?;
println!("Fetched entity configuration: {}", config_jwt);
Ok(())
}
```
## Standards Compliance
This implementation follows the OpenID Federation 1.0 specification (draft 43) and includes:
- Subordinate Statement format and validation
- Entity Configuration format and validation
- Trust Chain construction and validation
- Federation metadata policy operators
- Well-known endpoint discovery
- Federation-specific JWT claims and headers
- Comprehensive error handling
## Entity Types Supported
- **Federation Entity**: Core federation infrastructure
- **OpenID Connect Provider**: Identity providers in the federation
- **OpenID Connect Relying Party**: Clients in the federation
- **OAuth Authorization Server**: OAuth 2.0 authorization servers
- **OAuth Protected Resource**: Resource servers
- **OAuth Client**: OAuth 2.0 clients
## Architecture
The library is organized into several key modules:
- `entity`: Subordinate Statement and Entity Configuration structures
- `trust_chain`: Trust chain validation and processing
- `metadata`: All metadata types for different entity kinds
- `jwk`: JSON Web Key and JWK Set utilities
- `jwt`: JWT processing with federation extensions
- `types`: Common types and enums
- `utils`: Utility functions for HTTP, validation, and time handling
- `error`: Comprehensive error types
## License
Licensed under the Apache License, Version 2.0.