eduGAIN - Open ID Federation Pilot

Pilot Participation

Pilot participation is reserved to current eduGAIN Participants as listed on the eduGAIN Members page, https://technical.edugain.org/status. eduGAIN delegates and deputies can nominate or acknowledge the participation of anyone on their behalf. Here you can find information on how to submit a participation request, please refer to the pilot github repository for entities requirements and technical information: https://github.com/GEANT/edugain-oidf-pilot.

Participation requests

Requests for participation should be sent by the eduGAIN delegate or deputy to support@edugain.org with the following content:

• eduGAIN Participant name.
• The Entity Identifier of the Federation Trust Anchor.
• The Federation Trust Anchor public key in PEM format can be communicated in one of the following way:
  • sent as an attachment to the mail request if S/MIME signing is enabled with trusted (CAB/Forum) certificates, or
  • published on an HTTPS URL protected by trusted (CAB/Forum) certificates and pointing to the Federation Trust Anchor public key in PEM format. Please note that the HOST part of the URL is expected to insist on a domain in the remit of the organization.

Federations set up

The eduGAIN pilot team will process each request with the following process:

1. Verify that the request is complete and the PEM key is valid.
2. Query the configuration endpoint to obtain the Entity Configuration of the Federation Trust Anchor. The configuration endpoint is determined by concatenating the string /.well-known/openid-federation to the Entity Identifier.
3. Verify that the Entity Configuration is signed with the same key communicated in the request.
4. Verify that the federation signing key contained in the Entity Configuration is the same key communicated in the request.
5. Verify that the Federation Trust Anchor is compliant with all the requirements listed above.
6. If everything is ok, add the Federation Trust Anchor as a subordinate of the eduGAIN OIDF Pilot Trust Anchor.
7. Communicate to the requester that all is good and they've been officially on boarded to the pilot.

eduGAIN OIDF Pilot mailing list

Participants to the pilot will be added to the mailing list <edugain-oidf-pilot@lists.geant.org> https://lists.geant.org/sympa/info/edugain-oidf-pilot

Meetings

The pilot participants and the eduGAIN OIDF team members meet every two weeks on Monday at 12:00 UTC on 

https://geant.zoom.us/j/67057020195?pwd=b3q29nMTEEQZd4fADKZgbgEtytNCQF.1

The first meeting has been held on September 8th 2025.

Invites are periodically sent to the pilot mailing list.

Next 3 months meetings:

• 22 September 2025
• 6 October 2025
• 20 October 2025
• 3 November 2025
• 17 November 2025
• 1 December 2025
• 16 December 2025

Meeting notes (scribing doc):  

• https://docs.google.com/document/d/1eiigmnxUF6mmueaedCq6fSKeSOKtyoscw5EZoTHEOBM

Others

On 18 June 20258 the eduGAIN Service Team organised an infoshare. Please find the materials below:

• Slides: 
  • eduGAIN OpenID Federation Pilot - Infoshare June 18th 2025.pdf
  • go-oidfed.pdf
• Recordings: https://edu.nl/aj6ka and/or https://video.edu.nl/w/j9aMmfTvop2U4t63eFLjak

FAQ:

• I am interested to participate in the pilot. How can I join?
  • Write to support@edugain.org – start accepting candidates from June 30th 2025.
• Is there currently an Open ID Federation Technical Profile available?
  • Not yet, but we are working on it. If you like to contribute, please consider joining the eduGAIN Technical Profiles Working Group

Current Volunteers