OpenID Federation Trust Chain on Keycloak for Highly Assured Use Cases of Digital I...
summary
OpenID Federation 1.0 is implemented on Keycloak as an OP that validates a trust chain via trust anchors and intermediate authorities, offers both explicit client registration and automatic client registration, and creates client metadata + credentials after validation. A live demo uses Postman, a small JS intermediate authority and a Keycloak instance, posts an entity_configuration with JWKS URL, Keycloak validates the chain, stores the client and returns client_id/secret; samples exist but real deployments need further implementation and funding.
AI-written summary · about
chapters (8)
- 0:00OpenID Federation intro
- 1:25What is OpenID Federation
- 3:58OpenID Federation trust chain
- 4:19Digital Identity Wallets link
- 8:11Keycloak’s role
- 9:57Live demo: explicit client reg
- 14:01Key takeaways and future
- 15:28Q&A
related talks
31mDelegate Authentication and a Lot More To Keycloak With OpenID...
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
01h 12mIdentity 2.0: the what, why and how of social and federated login
29mNo More Secrets With Keycloak's Federated Client Authentication
01h 03mSingle Sign On with Keycloak: why and how
25mIdentities and Authentication for Your Agents With Keycloak
27mSimple Control: Managing Multi-Domain MCP Access Via Keycloak IdP With ID-JAG
40mA Walkthrough of Keycloak