OpenPubkey makes a client-side modification to OpenID Connect so that an ID Token issued by an OpenID Provider commits to a user held public key. This transforms an ID Token into a certificate that cryptographically binds an OpenID Connect identity to a public key. We call such an ID Token, a PK Token. The user can then sign messages with their signing key and these signatures can be authenticated and attributed to the user’s OpenID Connect identity. This allows OpenPubkey to upgrade OpenID Connect from Bearer Authentication to Proof-of-Possession, eliminating trust assumptions in OpenID Connect and defeating entire categories of attacks present in OpenID Connect. OpenPubkey was designed to satisfy a decade-long need for this functionality. Prior to OpenPubkey, OpenID Connect did not have a secure way for users to sign statements under their OpenID identities. OpenPubkey is transparent to users and OpenID Providers. An OpenID Provider can not even determine that OpenPubkey is being used. This makes OpenPubkey fully compatible with existing OpenID Providers. In fact a variant of OpenPubkey is currently deployed and used to authenticate signed messages and identities for users with accounts on Google, Microsoft, Okta, and Onelogin. OpenPubkey does not add new trusted parties to OpenID Connect and reduces preexisting trust assumptions. If used in tandem with our MFA-cosigner, OpenPubkey can maintain security even against a malicious OpenID Provider (the most trusted party in OpenID Connect).
Pocket ID | Easy Self-Hosted OIDC Provider with Passkeys
Pocket ID is an easy-to-use, self-hosted OpenID Connect Certified™ and OAuth 2.0 provider. Users sign in to your apps with passkeys instead of passwords.
Keycloak
Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum effort.
Revisiting Keyed-Verification Anonymous Credentials
As part of the Digital Library's transition to Open Access, new features for researchers are available in the Premium Edition. Click here to learn more.
Add openid4vp: as a safelisted scheme for protocol registration handling · Issue #11552 · whatwg/html
What problem are you trying to solve? In the context of digital wallets, the OpenID for Verifiable Presentations (OID4VP) 1.0 specification defines a new URI scheme, openid4vp:. The openid4vp: sche...
Proposal: OAuth-based account creation · bluesky-social atproto · Discussion #4587
We recently added to the reference PDS (and underlying OAuth Provider) implementation support for Initiating User Registration via OpenID Connect 1.0, however, what I wasn't aware of when I add...
Open Social Web ID - in commons
Approaching a shared method of single sign-on for the entire open social web.
OAuth Client ID Metadata Document
This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration. This is through the usage of a URL as a client_id in an OAuth flow, where the URL refers to a document containing the necessary client metadata, enabling the authorization server to fetch the metadata about the client as needed.
OAuth Client ID Metadata Document
This specification defines a mechanism through which an OAuth client can identify itself to authorization servers, without prior dynamic client registration or other existing registration. This is through the usage of a URL as a client_id in an OAuth flow, where the URL refers to a document containing the necessary client metadata, enabling the authorization server to fetch the metadata about the client as needed.
OAuth Improvements - AT Protocol
We've been making improvements to the end-user and developer experiences with atproto OAuth.
Does OpenID need to be hard?
Prompted by posts by Randy Reddig and Tony Stubblebine and a conversation with Elliott Kember, I wanted to address, yet again, the big fat stinking elephant in the room: OpenID usability and the pa…
Enterprise-Managed Authorization: Zero-touch OAuth for MCP
The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth.
google/longfellow-zk
Implementation of the Google Zero-Knowledge library for Identity Protocols.
this is kinda another reason im starting to think more and more that there would be worth in splitting atprotos identity layer out as its own spec and standard. building up handles and oauth around a DID makes for a really flexible cross platform (and potentially cross ecosystem) identity system
nel
i kinda hate how atproto adopting DIDs has made people intrinsically associate DIDs with atproto ... it makes some people see me as some annoying bitch trying to shove atproto into places it obviously doesnt belong in when i suggest using DIDs as user identifiers for other systems
So many people do not get this. Atproto identity is the closest thing to original-flavor OpenID that has been done in years. It's not OpenID (it has problems OpenID didn't and solves problems OpenID had), but it's very much in that spirit.
hailey
i guess in a way this is the most widely used one, but also one that is severely underused in other ways. definitely identity. i've long been of the opinion that there are obviously cool things that come from public data and all the public pieces of the proto, but identity is higher impact.
Just spent a bunch of time working on the Client ID Metadata Documents internet draft to make it possible to support multiple token endpoint authentication methods — github.com/oauth-wg/draft-ietf-oauth-cli…
Document token endpoint auth methods supported by ThisIsMissEm · Pull Request #99 · oauth-wg/draft-ietf-oauth-client-id-metadata-document
github.com
