Trust-Based Identity Sharing For Token Grants
Kavindu Dodanduwa, Ishara Kaluthanthri

TL;DR
This paper introduces a client-centric extension to OpenID Connect that enables secure identity sharing across different identity providers, simplifying access to resources in multi-domain environments.
Contribution
It proposes a novel extension to OpenID Connect allowing clients to exchange identity information with trusted providers, reducing the need for multiple identity store integrations.
Findings
Enables cross-domain resource access with a single token
Reduces complexity of managing multiple identity providers
Maintains security and trust in identity exchanges
Abstract
Authentication and authorization are two key elements of a software application. In modern day, OAuth 2.0 framework and OpenID Connect protocol are widely adopted standards fulfilling these requirements. These protocols are implemented into authorization servers. It is common to call these authorization servers as identity servers or identity providers since they hold user identity information. Applications registered to an identity provider can use OpenID Connect to retrieve ID token for authentication. Access token obtained along with ID token allows the application to consume OAuth 2.0 protected resources. In this approach, the client application is bound to a single identity provider. If the client needs to consume a protected resource from a different domain, which only accepts tokens of a defined identity provider, then the client must again follow OpenID Connect protocol to…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAccess Control and Trust · Cloud Data Security Solutions · Web Application Security Vulnerabilities
