SlideShare ist ein Scribd-Unternehmen logo
1 von 10
Downloaden Sie, um offline zu lesen
FHO Fachhochschule Ostschweiz
edu-ID Mobile App for Smart Environments
@phish108 @htwblc!
What happened so far …
@phish108 @htwblc
Authorization is about Trust
Organization
Trusted
User &
App Store
Trusted
Mobile DeviceService Federation
Untrusted
Personal Data
Internet
@phish108 @htwblc
Use-case 1: Responsive Web-Apps
(OpenID Connect / OAuth2 or SAML)
@phish108 @htwblc
Swiss Academic Domain
(Organisation Trusted)
University Server
SWITCH Server
Internet Mobile Device
(User and App Store Trusted)
EDUID Service
Academic Service
Web-App
@phish108 @htwblc
Use-case 2: Integrated Service
(AppAuth)
Swiss Academic Domain
(Organisation Trusted)
Mobile Device
(User and App Store Trusted)
University Server
SWITCH Server
Internet
EDUID Service
Academic Service
Web-Browser
Third Party App
IntegratedService
@phish108 @htwblc
Use-case 3: EduID Mobile App
(Token-agent assertions)
Swiss Academic Domain
(Organisation Trusted)
University Server
SWITCH Server
Internet Mobile Device
(User and App Store Trusted)
EDUID Service
(OIDC AP)
Academic Service
EDUID Mobile App
(Trust & Token Agent)
Third Party App
ExtendedTrustDomain
@phish108 @htwblc
EduID Mobile App Reference Architecture
Swiss Academic Domain
(Organisation Trusted)
University Server
SWITCH Server
Internet Mobile Device
(User and App Store Trusted)
EDUID Service
(OIDC AP)
Academic Service
EDUID Mobile App
(Trust & Token Agent)
Third Party App
OAuth2 Access Token
OAuth2 Access Token
Authorization Request
RFC 7521/7523 + RFC 7800
or App Auth
RFC 7521/7523 + RFC 7800
via RedirectURL
OIDC ID + OAuth2 Access Token
RFC 7521/7523 + RFC 7800
+ OIDC Scope
OIDC ID + OAuth2 Access Token
OAuth2 Access Token
ACL Handling
1
234
5
@phish108 @htwblc
EduID Mobile App Implementation Status
Swiss Academic Domain
(Organisation Trusted)
University Server
SWITCH Server
Internet Mobile Device
(User and App Store Trusted)
EDUID Service
(OIDC AP)
Academic Service
EDUID Mobile App
(Trust & Token Agent)
Third Party App
OAuth2 Access Token
OAuth2 Access Token
Authorization Request
RFC 7521/7523 + RFC 7800
or App Auth
RFC 7521/7523 + RFC 7800
via RedirectURL
OIDC ID + OAuth2 Access Token
RFC 7521/7523 + RFC 7800
+ OIDC Scope
OIDC ID + OAuth2 Access Token
OAuth2 Access Token
ACL Handling
1
234
5
NAIL Integration
iOS + Android
Cordova Plugin
Moodle OAuth2
+ JWE Support
OAuth2 & OIDC
Full-Stack Service
Node-OIDC-Provider Integration with LDAP Backend Support
• ES2017 + NodeJS 8
• LDAP-based User Management
• LDAP-based Service/Federation Management
• Separate Directory Organisation
• Configurable Attribute Mapping
• Full JOSE Support (strong JWE encryption covered)
• OIDC certified - details at: github.com/panva/node-oidc-provider
• OSS under MIT License
@phish108 @htwblc
OIDC Full Stack Implementation
For all 3 Use-cases + Web-Service Integration
Further reading http://htw.ac/eduid-mobile
@htwblc
http://htw.ac/blc-blog
FHO Fachhochschule Ostschweiz

Weitere ähnliche Inhalte

Was ist angesagt?

Orion Context Broker workshop (CPMX5)
Orion Context Broker workshop (CPMX5)Orion Context Broker workshop (CPMX5)
Orion Context Broker workshop (CPMX5)
Fermin Galan
 

Was ist angesagt? (20)

Consumerizing Industrial IoT Access Control: Using UMA to Add Privacy and Usa...
Consumerizing Industrial IoT Access Control: Using UMA to Add Privacy and Usa...Consumerizing Industrial IoT Access Control: Using UMA to Add Privacy and Usa...
Consumerizing Industrial IoT Access Control: Using UMA to Add Privacy and Usa...
 
A whistlestop tour of FHIR API authentication and authorization
A whistlestop tour of FHIR API authentication and authorizationA whistlestop tour of FHIR API authentication and authorization
A whistlestop tour of FHIR API authentication and authorization
 
Leveraging open banking specifications for rigorous API security – What’s in...
Leveraging open banking specifications for rigorous API security –  What’s in...Leveraging open banking specifications for rigorous API security –  What’s in...
Leveraging open banking specifications for rigorous API security – What’s in...
 
[WSO2Con USA 2018] Design and Implementation of the Veridium Authenticator: A...
[WSO2Con USA 2018] Design and Implementation of the Veridium Authenticator: A...[WSO2Con USA 2018] Design and Implementation of the Veridium Authenticator: A...
[WSO2Con USA 2018] Design and Implementation of the Veridium Authenticator: A...
 
CIS 2015 User Managed Access - George Fletcher
CIS 2015 User Managed Access - George FletcherCIS 2015 User Managed Access - George Fletcher
CIS 2015 User Managed Access - George Fletcher
 
The New Venn of Access Control in the API-Mobile-IOT Era
The New Venn of Access Control in the API-Mobile-IOT EraThe New Venn of Access Control in the API-Mobile-IOT Era
The New Venn of Access Control in the API-Mobile-IOT Era
 
Orion Context Broker webminar 2014 01-22
Orion Context Broker webminar 2014 01-22Orion Context Broker webminar 2014 01-22
Orion Context Broker webminar 2014 01-22
 
Spsnl18 exploring identity management options in office 365
Spsnl18   exploring identity management options in office 365Spsnl18   exploring identity management options in office 365
Spsnl18 exploring identity management options in office 365
 
CIS14: User-Managed Access
CIS14: User-Managed AccessCIS14: User-Managed Access
CIS14: User-Managed Access
 
Semantic web services
Semantic web servicesSemantic web services
Semantic web services
 
apidays LIVE Australia 2021 - Quantum Duality of “API as a business and a tec...
apidays LIVE Australia 2021 - Quantum Duality of “API as a business and a tec...apidays LIVE Australia 2021 - Quantum Duality of “API as a business and a tec...
apidays LIVE Australia 2021 - Quantum Duality of “API as a business and a tec...
 
Semantic Web Services: A RESTful Approach
Semantic Web Services: A RESTful ApproachSemantic Web Services: A RESTful Approach
Semantic Web Services: A RESTful Approach
 
Flexible DataSync: Fuel for new business opportunities
Flexible DataSync: Fuel for new business opportunitiesFlexible DataSync: Fuel for new business opportunities
Flexible DataSync: Fuel for new business opportunities
 
SPS Belgium 2015 - High-trust Apps for On-Premises Development
SPS Belgium 2015 -  High-trust Apps for On-Premises DevelopmentSPS Belgium 2015 -  High-trust Apps for On-Premises Development
SPS Belgium 2015 - High-trust Apps for On-Premises Development
 
Skaffolder Factom webinar
Skaffolder Factom webinarSkaffolder Factom webinar
Skaffolder Factom webinar
 
RSA Conference 2016: Don't Use Two-Factor Authentication... Unless You Need It!
RSA Conference 2016: Don't Use Two-Factor Authentication... Unless You Need It!RSA Conference 2016: Don't Use Two-Factor Authentication... Unless You Need It!
RSA Conference 2016: Don't Use Two-Factor Authentication... Unless You Need It!
 
MVP Virtual Conference - Introduction to AngularJS in an Office 365 Context
MVP Virtual Conference - Introduction to AngularJS in an Office 365 ContextMVP Virtual Conference - Introduction to AngularJS in an Office 365 Context
MVP Virtual Conference - Introduction to AngularJS in an Office 365 Context
 
Orion Context Broker workshop (CPMX5)
Orion Context Broker workshop (CPMX5)Orion Context Broker workshop (CPMX5)
Orion Context Broker workshop (CPMX5)
 
OWASP Chicago 2016 - What is Attribute Based Access Control (ABAC)?
OWASP Chicago 2016 - What is Attribute Based Access Control (ABAC)?OWASP Chicago 2016 - What is Attribute Based Access Control (ABAC)?
OWASP Chicago 2016 - What is Attribute Based Access Control (ABAC)?
 
A beginners guide to administering office 365 with power shell antonio maio
A beginners guide to administering office 365 with power shell   antonio maioA beginners guide to administering office 365 with power shell   antonio maio
A beginners guide to administering office 365 with power shell antonio maio
 

Ähnlich wie edu-ID Mobile App for Smart Environments

Presentatie Code Jam Niels van Dijk
Presentatie Code Jam Niels van DijkPresentatie Code Jam Niels van Dijk
Presentatie Code Jam Niels van Dijk
kirstenveelo
 
ISS SA le presenta los Escenarios para IdentityGuard de Entrust
ISS SA le presenta los Escenarios para IdentityGuard de EntrustISS SA le presenta los Escenarios para IdentityGuard de Entrust
ISS SA le presenta los Escenarios para IdentityGuard de Entrust
Information Security Services SA
 
Higgins active clients and personal data stores v2
Higgins active clients and personal data stores v2Higgins active clients and personal data stores v2
Higgins active clients and personal data stores v2
Paul Trevithick
 
BlueMix_IoT_Examples_PDF
BlueMix_IoT_Examples_PDFBlueMix_IoT_Examples_PDF
BlueMix_IoT_Examples_PDF
Thomas Digsby
 

Ähnlich wie edu-ID Mobile App for Smart Environments (20)

Presentatie Code Jam Niels van Dijk
Presentatie Code Jam Niels van DijkPresentatie Code Jam Niels van Dijk
Presentatie Code Jam Niels van Dijk
 
Understanding AWS security
Understanding AWS securityUnderstanding AWS security
Understanding AWS security
 
ISS SA le presenta los Escenarios para IdentityGuard de Entrust
ISS SA le presenta los Escenarios para IdentityGuard de EntrustISS SA le presenta los Escenarios para IdentityGuard de Entrust
ISS SA le presenta los Escenarios para IdentityGuard de Entrust
 
ISS SA le presenta los escenarios para IdentityGuard de Entrust
ISS SA le presenta los escenarios para IdentityGuard de EntrustISS SA le presenta los escenarios para IdentityGuard de Entrust
ISS SA le presenta los escenarios para IdentityGuard de Entrust
 
FIWARE IoT Proposal & Community
FIWARE IoT Proposal & CommunityFIWARE IoT Proposal & Community
FIWARE IoT Proposal & Community
 
Are you ready for Mobile?
Are you ready for Mobile?Are you ready for Mobile?
Are you ready for Mobile?
 
LOD2 Webinar Series: Virtuoso 7
LOD2 Webinar Series: Virtuoso 7LOD2 Webinar Series: Virtuoso 7
LOD2 Webinar Series: Virtuoso 7
 
Presentation cisco cloud security strategy
Presentation   cisco cloud security strategyPresentation   cisco cloud security strategy
Presentation cisco cloud security strategy
 
Developing Interoperable Components for an Open IoT Foundation
Developing Interoperable Components for an Open IoT Foundation Developing Interoperable Components for an Open IoT Foundation
Developing Interoperable Components for an Open IoT Foundation
 
Maarten Stultjens (Elephant Security) @ PIDS seminar
Maarten Stultjens (Elephant Security) @ PIDS seminarMaarten Stultjens (Elephant Security) @ PIDS seminar
Maarten Stultjens (Elephant Security) @ PIDS seminar
 
Creating a Java Internet of Things Gateway
Creating a Java Internet of Things GatewayCreating a Java Internet of Things Gateway
Creating a Java Internet of Things Gateway
 
Gab2016 - Découverte d'Azure IoT Hub
Gab2016 - Découverte d'Azure IoT Hub Gab2016 - Découverte d'Azure IoT Hub
Gab2016 - Découverte d'Azure IoT Hub
 
Mobile Cloud Identity
Mobile Cloud IdentityMobile Cloud Identity
Mobile Cloud Identity
 
Solving the IoT Challenge
Solving the IoT ChallengeSolving the IoT Challenge
Solving the IoT Challenge
 
IoT Platform Meetup - Oracle
IoT Platform Meetup - OracleIoT Platform Meetup - Oracle
IoT Platform Meetup - Oracle
 
Higgins active clients and personal data stores v2
Higgins active clients and personal data stores v2Higgins active clients and personal data stores v2
Higgins active clients and personal data stores v2
 
201410 1 fiware-overview
201410 1 fiware-overview201410 1 fiware-overview
201410 1 fiware-overview
 
BlueMix_IoT_Examples_PDF
BlueMix_IoT_Examples_PDFBlueMix_IoT_Examples_PDF
BlueMix_IoT_Examples_PDF
 
OpenID for Verifiable Credentials
OpenID for Verifiable CredentialsOpenID for Verifiable Credentials
OpenID for Verifiable Credentials
 
EOSC Ecosystem, EOSC-hub week, Prague
EOSC Ecosystem, EOSC-hub week, PragueEOSC Ecosystem, EOSC-hub week, Prague
EOSC Ecosystem, EOSC-hub week, Prague
 

Mehr von Christian Glahn

Mehr von Christian Glahn (20)

Personalisierung, Learning Design und Automatisierung mit Moodle
Personalisierung, Learning Design und Automatisierung mit MoodlePersonalisierung, Learning Design und Automatisierung mit Moodle
Personalisierung, Learning Design und Automatisierung mit Moodle
 
Digitale Lehre jenseits von Zoom und Moodle
Digitale Lehre jenseits von Zoom und MoodleDigitale Lehre jenseits von Zoom und Moodle
Digitale Lehre jenseits von Zoom und Moodle
 
Dialog und Prüfen im Flipped Classroom mit grossen Gruppen
Dialog und Prüfen im Flipped Classroom mit grossen GruppenDialog und Prüfen im Flipped Classroom mit grossen Gruppen
Dialog und Prüfen im Flipped Classroom mit grossen Gruppen
 
Adaptive Learning Experiences across Devices: Leveraging Multi-Modal Learnin...
Adaptive Learning Experiences across Devices: Leveraging Multi-Modal Learnin...Adaptive Learning Experiences across Devices: Leveraging Multi-Modal Learnin...
Adaptive Learning Experiences across Devices: Leveraging Multi-Modal Learnin...
 
Future Skills - Targetting curriculum innovation
Future Skills - Targetting curriculum innovationFuture Skills - Targetting curriculum innovation
Future Skills - Targetting curriculum innovation
 
Flexibel in neuen Kontexten lernen
Flexibel in neuen Kontexten lernenFlexibel in neuen Kontexten lernen
Flexibel in neuen Kontexten lernen
 
Mobiles Lernen gestalten
Mobiles Lernen gestaltenMobiles Lernen gestalten
Mobiles Lernen gestalten
 
The Multiple Apps and Devices of Swiss Freshmen University Students
The Multiple Apps and Devices of Swiss Freshmen University StudentsThe Multiple Apps and Devices of Swiss Freshmen University Students
The Multiple Apps and Devices of Swiss Freshmen University Students
 
Getting Ready for the EC-TEL Doctoral Consortium
Getting Ready for the EC-TEL Doctoral ConsortiumGetting Ready for the EC-TEL Doctoral Consortium
Getting Ready for the EC-TEL Doctoral Consortium
 
Design Thinking for Technology Enhanced Learning
Design Thinking for Technology Enhanced LearningDesign Thinking for Technology Enhanced Learning
Design Thinking for Technology Enhanced Learning
 
Designing Mobile Inquiry-based Learning Activities: Learners' Agency and Tech...
Designing Mobile Inquiry-based Learning Activities: Learners' Agency and Tech...Designing Mobile Inquiry-based Learning Activities: Learners' Agency and Tech...
Designing Mobile Inquiry-based Learning Activities: Learners' Agency and Tech...
 
Design Thinking for Learning Analytics
Design Thinking for Learning AnalyticsDesign Thinking for Learning Analytics
Design Thinking for Learning Analytics
 
Learning Design for Teachers in a Hurry
Learning Design for Teachers in a HurryLearning Design for Teachers in a Hurry
Learning Design for Teachers in a Hurry
 
Integrating Native Mobile Apps into Institutional Ed-Tech Ecosystems
Integrating Native Mobile Apps into Institutional Ed-Tech EcosystemsIntegrating Native Mobile Apps into Institutional Ed-Tech Ecosystems
Integrating Native Mobile Apps into Institutional Ed-Tech Ecosystems
 
How short can you make learning?
How short can you make learning?How short can you make learning?
How short can you make learning?
 
Getting Ready for the ECTEL Doctoral Consortium, Part 2
Getting Ready for the ECTEL Doctoral Consortium, Part 2Getting Ready for the ECTEL Doctoral Consortium, Part 2
Getting Ready for the ECTEL Doctoral Consortium, Part 2
 
Getting Ready for the ECTEL Doctoral Consortium, Part 1
Getting Ready for the ECTEL Doctoral Consortium, Part 1Getting Ready for the ECTEL Doctoral Consortium, Part 1
Getting Ready for the ECTEL Doctoral Consortium, Part 1
 
10th eduhub days, 18 years Swiss Virtual Campus - looking back and looking fo...
10th eduhub days, 18 years Swiss Virtual Campus - looking back and looking fo...10th eduhub days, 18 years Swiss Virtual Campus - looking back and looking fo...
10th eduhub days, 18 years Swiss Virtual Campus - looking back and looking fo...
 
Augmented Learning for the Digital Campus
Augmented Learning for the Digital CampusAugmented Learning for the Digital Campus
Augmented Learning for the Digital Campus
 
Blended Learning Konkret
Blended Learning KonkretBlended Learning Konkret
Blended Learning Konkret
 

Kürzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

Kürzlich hochgeladen (20)

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 

edu-ID Mobile App for Smart Environments

  • 1. FHO Fachhochschule Ostschweiz edu-ID Mobile App for Smart Environments @phish108 @htwblc!
  • 2. What happened so far … @phish108 @htwblc
  • 3. Authorization is about Trust Organization Trusted User & App Store Trusted Mobile DeviceService Federation Untrusted Personal Data Internet @phish108 @htwblc
  • 4. Use-case 1: Responsive Web-Apps (OpenID Connect / OAuth2 or SAML) @phish108 @htwblc Swiss Academic Domain (Organisation Trusted) University Server SWITCH Server Internet Mobile Device (User and App Store Trusted) EDUID Service Academic Service Web-App
  • 5. @phish108 @htwblc Use-case 2: Integrated Service (AppAuth) Swiss Academic Domain (Organisation Trusted) Mobile Device (User and App Store Trusted) University Server SWITCH Server Internet EDUID Service Academic Service Web-Browser Third Party App IntegratedService
  • 6. @phish108 @htwblc Use-case 3: EduID Mobile App (Token-agent assertions) Swiss Academic Domain (Organisation Trusted) University Server SWITCH Server Internet Mobile Device (User and App Store Trusted) EDUID Service (OIDC AP) Academic Service EDUID Mobile App (Trust & Token Agent) Third Party App ExtendedTrustDomain
  • 7. @phish108 @htwblc EduID Mobile App Reference Architecture Swiss Academic Domain (Organisation Trusted) University Server SWITCH Server Internet Mobile Device (User and App Store Trusted) EDUID Service (OIDC AP) Academic Service EDUID Mobile App (Trust & Token Agent) Third Party App OAuth2 Access Token OAuth2 Access Token Authorization Request RFC 7521/7523 + RFC 7800 or App Auth RFC 7521/7523 + RFC 7800 via RedirectURL OIDC ID + OAuth2 Access Token RFC 7521/7523 + RFC 7800 + OIDC Scope OIDC ID + OAuth2 Access Token OAuth2 Access Token ACL Handling 1 234 5
  • 8. @phish108 @htwblc EduID Mobile App Implementation Status Swiss Academic Domain (Organisation Trusted) University Server SWITCH Server Internet Mobile Device (User and App Store Trusted) EDUID Service (OIDC AP) Academic Service EDUID Mobile App (Trust & Token Agent) Third Party App OAuth2 Access Token OAuth2 Access Token Authorization Request RFC 7521/7523 + RFC 7800 or App Auth RFC 7521/7523 + RFC 7800 via RedirectURL OIDC ID + OAuth2 Access Token RFC 7521/7523 + RFC 7800 + OIDC Scope OIDC ID + OAuth2 Access Token OAuth2 Access Token ACL Handling 1 234 5 NAIL Integration iOS + Android Cordova Plugin Moodle OAuth2 + JWE Support OAuth2 & OIDC Full-Stack Service
  • 9. Node-OIDC-Provider Integration with LDAP Backend Support • ES2017 + NodeJS 8 • LDAP-based User Management • LDAP-based Service/Federation Management • Separate Directory Organisation • Configurable Attribute Mapping • Full JOSE Support (strong JWE encryption covered) • OIDC certified - details at: github.com/panva/node-oidc-provider • OSS under MIT License @phish108 @htwblc OIDC Full Stack Implementation For all 3 Use-cases + Web-Service Integration