This activity attempts to extend the IdP/SP software SimpleSAMLphp with the still missing OpenID Connect Provider interface.

The aim of this activity is to create a functional OIDC OpenID Provider module for SimpleSAMLphp and provide it upstream.

SimpleSAMLphp (SSP) is a commonly used software product for both SP and IdP deployments in Research and Education. In addition it may also be deployed as a proxy. Next to SAML, various other authentication protocols are supported.While SSP already supports the OpenID Connect (OIDC) Relaying Party (RP) interface, an OIDC OpenID Provider (OP) implementation is missing.

Adding an OIDC OP would add the ability to run a SSP based identity provider in 'dual stack' providing both SAML and OIDC based authentication using the same authoritative database. In addition it would improve SSPs proxy capability by allow it to proxy from SAML based IdPs (itself acting as an SP) to OIDC based RPs (itself acting as an OP).

This activity seeks to implement an OIDC OP in accordance with the OIDC specification into SSP.

There is an existing module available at Github. It needs to be investigated whether this is suitable for this activity.

SSP is one of the most widely used IdP/SP software in the GÉANT community. Furthermore, the adoption of OIDC is growing steadily, especially third-parties use it commonly. The OP module offers NRENs and institutions an easy way to provide an OIDC IdP. 

• Parallel implementation of different solutions
• Failure to provide the module upstream

• The activity itself does not handle any sensitive data
• The created module will be integrated into an IdP and therefore handle authentication related user information

• An SSP OIDC OP architecture is created and documented
• A working SSP module is created and tested
• A security review is performed to ensure the module does not affect SSP security or privacy
• The SSP module is published publicly and picked up by a maintainer

• The source code and interface documentation will be published publicly on GitHub
• The module will be provided to the SSP developers or a related project for maintenance

The activity is still ongoing