SPID/CIE OIDC Federation Entity
Project description
SPID/CIE OIDC Federation SDK
⚠️ This project is a WiP, the first stable release for production use will be the v0.6.0.
SPID/CIE OIDC Federation is a suite of Django applications designed to make it easy to build an Openid Connect Federation, each of these can be installed separately within a django project. These are the following:
| Application | Description |
|---|---|
| spid_cie_oidc.accounts | Customizable application that extends the django User model. |
| spid_cie_oidc.entity | OpenID Connect Federation django app that implements OIDC Federation 1.0 Entity Statements, metadata discovery, Trust Chain, Trust Marks and Metadata policy. Technical specifications: OIDC Federation Entity |
| spid_cie_oidc.authority | OpenID Connect Federation API and models for OIDC Federation Authority/Intermediary, Technical specifications and tutorial. |
| spid_cie_oidc.onboarding | OpenID Connect Federation onboarding demo service and tools |
| spid_cie_oidc.relying_party | OpenID Connect Relying Party and test suite for OIDC Providers |
| spid_cie_oidc.provider | OpenID Connect Provider and test suite for OIDC Relying Parties |
Summary
Setup
All the Django apps are available in the folder spid_cie_oidc/.
The examples projects are available in the folder examples/.
There is a substantial difference between an app and a project. The app is installed using a common python package manager, such as poetry or pip, and can be used, inherited, and integrated into other projects.
A project is a service configuration that integrates one or more applications. In this repository we have three example projects:
- federation_authority
- relying_party
- provider
Federation Authority loads all the applications for development needs, acting as both authority, RP and OP. This allows us to make a demo by starting a single service. See admin page
http://127.0.0.1:8000/admin/and user login pagehttp://127.0.0.1:8000/oidc/rp/landing/.
relying party and provider are examples that only integrate spid_cie_oidc.entity and spid_cie_oidc.provider or .relying_party.
Read the setup documentation to get started.
Docker compose
TODO: Not available until v0.6.0 release
Usage
The demo propose a small federation composed by the following entities:
- Federation Authority, acts as trust anchor and onboarding system. It's available at
http://127.0.0.1:8000/ - OpenID Relying Party, available at
http://127.0.0.1:8001/ - OpenID Provider, available at
http://127.0.0.1:8002/
Examples Users and Passwords:
- admin oidcadmin
- user oidcuser
Tools
The OnBoarding app comes with the following collection of tools:
- JWK
- Create a jwk
- Convert a private JWK to PEM
- Convert a public JWK to PEM
- Convert a private PEM to JWK
- Convert a public PEM to JWK
- JWT decode and verification
- Federation
- Resolve entity statement
- Apply policy
- Validators
- Validate OP metadata spid
- Validate OP metadata cie
- Validate RP metadata spid
- Validate RP metadata cie
- Validate Authn Request spid
- Validate Authn Request cie
- Validate Entity Configuration
- Trust mark validation
- Schemas
- Authorization Endpoint
- Introspection Endpoint
- Metadata
- Token Endpoint
- Revocation Endpoint
- Jwt client Assertion
Contribute
Your contribution is welcome, no question is useless and no answer is obvious, we need you.
Contribute as end user
Please open an issue if you've discoveerd a bug or if you want to ask some features.
Contribute as developer
Please open your Pull Requests on the dev branch. Please consider the following branches:
- main: where we merge the code before tag a new stable release.
- dev: where we push our code during development.
- other-custom-name: where a new feature/contribution/bugfix will be handled, revisioned and then merged to dev branch.
Backup and share your demo data
# backup your data (upgrade example data), -e excludes.
./manage.py dumpdata -e admin -e spid_cie_oidc_relying_party -e spid_cie_oidc_provider -e spid_cie_oidc_relying_party_test -e auth -e contenttypes -e sessions --indent 2 > dumps/example.json
In this project we adopt Semver and Conventional commits specifications.
Implementation notes
All the operation related to JWT signature and encryption are built on top of IdentityPython cryptojwt
This project proposes an implementation of the italian OIDC Federation profile with automatic_client_registration and the adoption of the trust marks as mandatory.
If you're looking for a fully compliant implementation of OIDC Federation 1.0, with a full support of explicit client registration, please look at idpy's fedservice.
General Features
- SPID and CIE OpenID Connect Provider
- SPID and CIE OpenID Connect Relying Party
- OIDC Federation onboarding demo service
- OIDC Federation 1.0
- Trust Anchor and Intermediary
- Automatic client registration
- Entity profiles and Trust marks
- Trust chain storage and discovery
- Entity statement resolve endpoint
- Fetch statement endpoing
- List entities endpoint
- Advanced List endpoint
- Federation CLI
- RP: build trust chains for all the available OPs
- OP: build trust chains for all the available RPs
- Multitenancy, a single service can configure many entities like RPs, OP, Trust Anchors and intermediaries
- gettext compliant (i18n)
- Bootstrap Italia Design templates
License and Authors
This software is released under the Apache 2 License by:
- Giuseppe De Marco giuseppe.demarco@teamdigitale.governo.it.
In this project we use the metadata policy code written by Roland Hedberg and licensed under the same Apache 2 license.
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file spid_cie_oidc-0.4.16.tar.gz.
File metadata
- Download URL: spid_cie_oidc-0.4.16.tar.gz
- Upload date:
- Size: 358.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.0 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.11
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | f0191d1b11881f51ee69e47ffef844d735050102630509fc1aec291d4f0a0d9e |
|
| MD5 | 61b6e47d8fe9445b11337cb2937ed44d |
|
| BLAKE2b-256 | f01bcd875af9803a79fa21365f768cb185ee2d2eeec3134520788567b47438b8 |
File details
Details for the file spid_cie_oidc-0.4.16-py3-none-any.whl.
File metadata
- Download URL: spid_cie_oidc-0.4.16-py3-none-any.whl
- Upload date:
- Size: 436.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.0 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.11
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 3f672ca6702a35a2eede0790587d7bcd59dc50e20875193f31c876e51980c9a2 |
|
| MD5 | d86f7e96be32b83932766897208f4d6d |
|
| BLAKE2b-256 | dd189b6c228ba178b5d06b1825017e606cc1844d7106af6da12e2848d763c17f |
