is OpenID Connect on the roadmap?

[mike at gluu.org]

Shib devs,

I don't have time to give a full briefing on my assessment of the
opportunities for Higher Ed and OpenID Connect in a short email, but I
think its worth making a few points here:

1) The idea that OpenID Connect is only for large consumer IDPs is
misleading. I think the idea is that universities need to use the same
federation protocol as large consumer IDPs--but obviously your "university
identity" is needed to control access to university resources.  For better
or worse, SAML has not been widely adopted by websites on the Internet.
While large websites have adopted (Google, Salesforce, government...),
many websites find that SAML is not developer friendly (note: I did not
say "too hard"). At the end of the day, its content that will either drive
(or not drive) adoption of OpenID Connect. If website developers find
OpenID Connect more developer friendly, and create a lot of compelling
content that universities want, there will be a clear business case for
adoption.

2) Trust models are not about protocols. It would be relatively trivial
for InCommon or any other federation to publish its metadata in a new
format. With regard to OpenID Connect, Gluu has a proposal for multi-party
federation metadata:
 http://wiki.openid.net/w/page/59727624/Multi-Party%20Federations 
Feedback is welcome. (BTW, several people already hassled me about the
fact that entities are not "flat.")

3) OAuth2 went standard at the IETF several weeks ago. This is a major
achievement, and dismissing it is misleading. The JOSE standard is in the
final stages of approval--this is the JSON equivalent of SAML assertions
(signed tokens). As JOSE is a dependency, OpenID Connect will go standard
shortly thereafter. My unofficial, totally un-endorsed assessment is that
we are looking at a final OpenID Connect standard by June 2013.
Enhancements to the core spec (for example multi-party federations
mentioned above) will have to come after the core spec is released.

4) Peter is correct that IDP initiated workflow is out of scope for OpenID
Connect. SSO with internal applications can however be achieved, but this
is not the forum to go into the technical details...

5) In my opinion, having a hook for authorization at the IDP greatly
improves an IDP's functionality. Although YouApprove was good work, this
is something SAML never addressed with proven usability.  Authorization
hooks can be used by the IDP to connect to external policy evaluation
engines (XACML, UMA, Repose, custom...). I think this both enhances an
organizations ability to control access to both internal and external
resources, and to give users some ability to decide for themselves to
release certain information, which is necessary if you want people to
leverage their university creds. I don't see any industry momentum to add
authorization capabilities to SAML. In fact SAML seems pretty much "done"
at this point.

With that said... at a high level, I completely agree with Peter's
conclusion, but for a slightly different reason. I made the case to Nicole
Harris at RSA Europe that perhaps the Shibboleth Foundation should align
with the OX project (http://ox.gluu.org) for OpenID Connect support. All
OX code is currently MIT license (could be converted to Apache2), and the
server is one of the most comprehensive (as confirmed in the last interop:
http://openidtest.uninett.no/results) How is Shibboleth going to add value
by re-implementing the same endpoints?

Furthermore, Gluu plans to open source the GUI that we've developed for
Shibboleth in the very near future (next 60 days). This has been in the
works for a long time. It will not make sense for everyone, but I think it
will be useful for some, and would also perhaps provide another reason to
align the Shibboleth and OX projects.

If anyone wants to discuss the future of OpenID Connect further, it could
be a good topic for a webinar, or something more efficient than a long
email thread :-)

- Mike Schwartz

------------------------------------------
Michael Schwartz
CEO Gluu
http://gluu.org
twitter: @gluufederation