Skip to content

Commit 0a04a5c

Browse files
dickhardtdickhardt
committed
initial commit
1 parent d682bde commit 0a04a5c

File tree

5 files changed

+354
-2
lines changed

5 files changed

+354
-2
lines changed

‎.github/workflows/gh-pages.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: gh-pages
2+
3+
on:
4+
# Runs on pushes targeting the default branch
5+
push:
6+
paths-ignore:
7+
- README.md
8+
- CONTRIBUTING.md
9+
- LICENSE.md
10+
- .gitignore
11+
- '.github/**'
12+
branches: ["*"]
13+
release:
14+
types:
15+
- created
16+
- edited
17+
18+
# Allows you to run this workflow manually from the Actions tab
19+
workflow_dispatch:
20+
21+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
22+
permissions:
23+
contents: write
24+
pages: write
25+
id-token: write
26+
27+
# Allow one concurrent deployment
28+
concurrency:
29+
group: "pages"
30+
cancel-in-progress: true
31+
32+
jobs:
33+
build-and-deploy:
34+
environment:
35+
name: github-pages
36+
url: ${{ steps.deployment.outputs.page_url }}
37+
runs-on: ubuntu-latest
38+
env:
39+
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
40+
steps:
41+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
42+
- uses: actions/checkout@v3
43+
44+
45+
- name: Set up Go
46+
uses: actions/setup-go@v3
47+
with:
48+
go-version: '1.20'
49+
50+
- name: Install mmark
51+
run: go install github.com/mmarkdown/mmark@latest
52+
53+
- name: Convert Markdown to RFC XML with MMark
54+
run: |
55+
mmark openid-provider-commands-1_0.md > openid-provider-commands-1_0.xml
56+
57+
- name: Set up Python
58+
uses: actions/setup-python@v4
59+
with:
60+
python-version: '3.10'
61+
- name: Install xml2rfc
62+
run: pip install xml2rfc
63+
64+
65+
- name: Show env
66+
run: echo "$GITHUB_CONTEXT"
67+
68+
- name: Create html folder
69+
run: mkdir html
70+
71+
- name: Show folders
72+
run: ls -al
73+
74+
- name: Show branch name
75+
run: echo "$BRANCH_NAME"
76+
77+
78+
- name: Render HTML
79+
run: xml2rfc --html openid-provider-commands-1_0.xml --out html/$BRANCH_NAME.html
80+
81+
- name: Deploy to GitHub Pages
82+
if: success()
83+
uses: crazy-max/ghaction-github-pages@v2
84+
with:
85+
target_branch: gh-pages
86+
build_dir: html
87+
keep_history: true
88+
env:
89+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
91+
92+
# - name: Setup Pages
93+
# uses: actions/configure-pages@v5
94+
95+
# - name: Upload artifact
96+
# uses: actions/upload-pages-artifact@v3
97+
# with:
98+
# # Upload entire repository
99+
# path: 'html'
100+
# env:
101+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# MacOS
2+
.DS_store

‎CONTRIBUTING.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# How to Contribute
2+
3+
The OpenID Connect working group page is https://openid.net/wg/connect/. It describes how to participate in the working group, including OpenID Federation.
4+
5+
You can send feedback on the specification in a way that enables the working group to act upon it by
6+
1. signing the contribution agreement at https://openid.net/intellectual-property/ to join the working group (please specify that you are joining the “AB/Connect” working group on your contribution agreement),
7+
2. joining the working group mailing list at https://lists.openid.net/mailman/listinfo/openid-specs-ab, and
8+
3. sending your feedback to the list.
9+
10+
Working group members can also contribute via GitHub.
11+
12+
When contributing, please adhere to the following guidelines:
13+
14+
- **Issues**: Use the issue tracker to report problems or suggest enhancements.
15+
- **Pull Requests**: Submit pull requests linked to Issues that were approved during a Working Group call.
16+
- **Commit Messages**: Use clear and descriptive commit messages.
17+
18+
Thanks,<br/>
19+
OpenID Connect Working Group

‎README.md‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,32 @@
1-
# connect-enterprise-extensions
2-
OpenID Connect Enterprise Extensions Specification
1+
# OpenID Connect Enterprise Extensions 1.0
2+
3+
This repository contains the OpenID Connect Enterprise Extensions specification, a work item in the A/B Working Group.
4+
5+
## Overview
6+
7+
OpenID Connect Enterprise Extensions is a collection of additional items that have either become commonly used in deployments, or are features that are needed in other specifications such as OpenID Provider Commands, a work item in the A/B Working Group, and work items in the Interoperability Profiling for Secure Identity in the Enterprise (IPSIE) Work Group.
8+
9+
## Status
10+
11+
12+
The latest released draft of the specification is available at [https://openid.net/specs/openid-connect-enterprise-extensions-1_0.html](https://openid.net/specs/openid-connect-enterprise-extensions-1_0.html).
13+
14+
15+
## Builds
16+
17+
You can view the latest editors' draft at [https://openid.github.io/openid-connect-enterprise-extensions/main.html](https://openid.github.io/openid-connect-enterprise-extensions/main.html).
18+
19+
Previews for each branch of this project are automatically built and published at the URL https://openid.github.io/openid-connect-enterprise-extensions/$branchname.html.
20+
Previews for branches associated with pending Pull Requests are accessible using this pattern.
21+
22+
## Getting Started
23+
To get started working on the OpenID Provider Commands specification, clone this repository and review the documentation provided in the root directory.
24+
25+
````bash
26+
git clone https://github.com/openid/connect-enterprise-extensions.git
27+
cd connect-enterprise-extensions
28+
````
29+
Please read the [CONTRIBUTING.md](CONTRIBUTING.md) to learn how to contribute to this project.
30+
31+
## Contact
32+
For further information and to get involved, please visit the [OpenID Connect Working Group website](https://openid.net/wg/connect/).

‎openid-connect-enterprise-extensions-1_0.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
%%%
2+
title = "OpenID Connect Enterprise Extensions 1.0 - draft 00"
3+
abbrev = "openid-connect-enterprise-extensions"
4+
ipr = "none"
5+
workgroup = "OpenID Connect"
6+
keyword = ["security", "openid", "enterprise"]
7+
8+
[seriesInfo]
9+
name = "Internet-Draft"
10+
value = "openid-connect-commands-1_0"
11+
status = "standard"
12+
13+
[[author]]
14+
initials="D."
15+
surname="Hardt"
16+
fullname="Dick Hardt"
17+
organization="Hellō"
18+
[author.address]
19+
email = "[email protected]"
20+
21+
[[author]]
22+
initials="K."
23+
surname="McGuinness"
24+
fullname="Karl McGuinness"
25+
organization="Independent"
26+
[author.address]
27+
email = "[email protected]"
28+
29+
%%%
30+
31+
.# Abstract
32+
33+
OpenID Connect 1.0 has become a popular choice for single sign on in enterprise use cases. To improve interoperability, OpenID Connect Enterprise Extensions specifies a number of common or desirable extensions to OpenID Connect.
34+
35+
36+
37+
{mainmatter}
38+
39+
# Introduction
40+
41+
42+
OpenID Connect 1.0 is a widely adopted identity protocol that enables client applications, known as relying parties (RPs), to verify the identity of end-users based on authentication performed by a trusted service, the OpenID Provider (OP).
43+
44+
Initial adoption of OpenID Connect was by sites providing personal identity to applications. OpenID Connect has become a popular choice in enterprise use cases, and implementors have defined their own extensions for use cases that were not addressed in the original specification.
45+
46+
To improve interoperability between systems, OpenID Connect Enterprise Extensions specifies optional claims that may be included in an ID Token, optional parameters that may be included in an authentication request, and optional parameters optional parameters that may be included in when initiating login from a third party.
47+
48+
49+
50+
## Requirements Notation and Conventions
51+
52+
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
53+
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this
54+
document are to be interpreted as described in [RFC2119](#RFC2119).
55+
56+
In the .txt version of this specification,
57+
values are quoted to indicate that they are to be taken literally.
58+
When using these values in protocol messages,
59+
the quotes MUST NOT be used as part of the value.
60+
In the HTML version of this specification,
61+
values to be taken literally are indicated by
62+
the use of *this fixed-width font*.
63+
64+
## Terminology
65+
66+
This specification defines the following terms:
67+
68+
- **Account**: A set of claims about a user.
69+
70+
- **Tenant**: A logically isolated entity within an OP that represents a distinct organizational or administrative boundary. An OP may have a single Tenant, or multiple Tenants. The Tenant may contain Accounts managed by individuals, or may contain Accounts managed by an organization.
71+
72+
# ID Token Claims
73+
74+
An ID Token is defined in Section 2 of [OpenID Connect Core 1.0](#OpenID Connect Core 1.0).
75+
76+
Following are OPTIONAL claims that may be included in an ID Token:
77+
78+
## session_expiry
79+
80+
The `session_expiry` claim is a JSON integer that represents the Unix timestamp (seconds since epoch) indicating when a session created from the ID Token MUST expire.
81+
82+
## tenant
83+
84+
The `tenant` claim is an opaque JSON string that represents a tenant identifier and MAY have the value `personal`, `organization` or a stable OP unique value for multi-tenant OPs. The `personal` value is reserved for when Accounts are managed by individuals. The `organization` value is reserved for Accounts managed by an organization.
85+
86+
87+
# Authentication Request Parameters
88+
89+
An Authentication request is defined in Section 3.1.2.1 of [OpenID Connect Core 1.0](#OpenID Connect Core 1.0).
90+
91+
Following are OPTIONAL parameters that may be included in an Authentication Request:
92+
93+
## domain_hint
94+
95+
The `domain_hint` parameter provides a hint for the OP to determine which Tenant to present to the user to authenticate to.
96+
97+
## tenant
98+
99+
The `tenant` identifier per the `tenant` claim for the OP Tenant that the RP would like the user to be authenticated to. Passing a `tenant` value of `personal` indicates the RP would like the user to use an account managed by user. Passing a `tenant` value of `organization` indicates the RP would like the user to use an account managed by an organization.
100+
101+
102+
# Login from a Third Party Parameters
103+
104+
Initiating a login from a third party and a login initiation endpoint are defined in Section 4 of [OpenID Connect Core 1.0](#OpenID Connect Core 1.0).
105+
106+
Following are OPTIONAL parameters that may be included in request to the login initiation endpoint:
107+
108+
## client_id
109+
110+
The `client_id` value the RP should use when making the Authentication Request. This allows an multi-tenant application that hosts multiple tenants, each represented by a different `client_id`, to know which `client_id` to use.
111+
112+
## domain_hint
113+
114+
The `domain_hint` value to be included in the Authentication Request.
115+
116+
## tenant
117+
118+
The `tenant` value to be included in the Authentication Request.
119+
120+
121+
# Security Considerations
122+
123+
*To be completed.*
124+
125+
126+
127+
# Privacy Considerations
128+
129+
*To be completed.*
130+
131+
# IANA Considerations
132+
133+
*To be completed.*
134+
135+
136+
# References
137+
138+
## Normative References
139+
140+
- **[RFC2119]** Bradner, S. “Key words for use in RFCs to Indicate Requirement Levels,” *RFC 2119*, March 1997.
141+
- **[OpenID Connect Core 1.0]** – “OpenID Connect Core 1.0 incorporating errata set 1,” available at <https://openid.net/specs/openid-connect-core-1_0.html>.
142+
143+
## Informative References
144+
145+
- **IANA JSON Web Token Claims Registry**, available at <https://www.iana.org/assignments/jwt/jwt.xhtml>.
146+
- **IANA OAuth Parameters**, available at <https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#client-metadata>.
147+
148+
{backmatter}
149+
150+
# Acknowledgements
151+
152+
*To be updated.*
153+
154+
# Notices
155+
156+
Copyright (c) 2025 The OpenID Foundation.
157+
158+
The OpenID Foundation (OIDF) grants to any Contributor, developer,
159+
implementer, or other interested party a non-exclusive, royalty free,
160+
worldwide copyright license to reproduce, prepare derivative works from,
161+
distribute, perform and display, this Implementers Draft, Final
162+
Specification, or Final Specification Incorporating Errata Corrections
163+
solely for the purposes of (i) developing specifications,
164+
and (ii) implementing Implementers Drafts, Final Specifications,
165+
and Final Specification Incorporating Errata Corrections based
166+
on such documents, provided that attribution be made to the OIDF as the
167+
source of the material, but that such attribution does not indicate an
168+
endorsement by the OIDF.
169+
170+
The technology described in this specification was made available
171+
from contributions from various sources, including members of the OpenID
172+
Foundation and others. Although the OpenID Foundation has taken steps to
173+
help ensure that the technology is available for distribution, it takes
174+
no position regarding the validity or scope of any intellectual property
175+
or other rights that might be claimed to pertain to the implementation
176+
or use of the technology described in this specification or the extent
177+
to which any license under such rights might or might not be available;
178+
neither does it represent that it has made any independent effort to
179+
identify any such rights. The OpenID Foundation and the contributors to
180+
this specification make no (and hereby expressly disclaim any)
181+
warranties (express, implied, or otherwise), including implied
182+
warranties of merchantability, non-infringement, fitness for a
183+
particular purpose, or title, related to this specification, and the
184+
entire risk as to implementing this specification is assumed by the
185+
implementer. The OpenID Intellectual Property Rights policy
186+
(found at openid.net) requires
187+
contributors to offer a patent promise not to assert certain patent
188+
claims against other contributors and against implementers.
189+
OpenID invites any interested party to bring to its attention any
190+
copyrights, patents, patent applications, or other proprietary rights
191+
that may cover technology that may be required to practice this
192+
specification.
193+
194+
# Document History
195+
196+
[[ To be removed from the final specification ]]
197+
198+
-00
199+
200+
initial draft

0 commit comments

Comments
 (0)