1. OpenID Connect: An Overview Pat Patterson Developer Evangelist Architect salesforce.com @metadaddy

2. What is OpenID Connect? Simple Identity Layer for the Internet [OpenID Connect] allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.

3. What is OpenID Connect? Specification defined by OpenID Foundation ‘Connect’ Work Group – NRI, Ping Identity, Microsoft, Google, Salesforce etc Built on OAuth 2.0 REST-based Successor to SAML?

4. OpenID Connect Status ‘Nearly complete’ – Second set of OpenID Connect Implementer’s Drafts approved in July, 2013 – Interop testing under way – Waiting for dependencies to be standardized JWT, JWS etc

5. OpenID Connect Specification OpenID Connect 1.0 Specification – Core – Discovery (optional) – Dynamic Registration (optional) – Session Management (optional) – OAuth 2.0 Multiple Response Types Implementer’s Guides – Basic Client Profile – Implicit Client Profile

6. OpenID Connect Roles Web-based, mobile, or JavaScript Clients verify the identity of End-Users based on authentication performed by an Authorization Server.

7. OpenID Connect Basic Client Profile

8. OpenID Connect Implicit Client Profile

9. OpenID Connect Token Response { "access_token":"SlAV32hkKG", "token_type":"Bearer", "expires_in":3600, "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA", "id_token":"eyJ0... NiJ9.eyJ1c... ZXso” } id_token is a JSON Web Token (JWT) – Signed, URL/filename-safe base64 encoded JSON data

10. OpenID Connect ID Token { "iss": "https://server.example.com", "sub": "24400320", "aud": "s6BhdRkqt3", "exp": 1311281970, "iat": 1311280970 } Issuer, Subject, Audience, Expiry, Issued At Also optional email, auth_time, nonce etc

11. Who is Deploying OpenID Connect? Services: Google, Salesforce, eBay, AOL, Deutsche Telekom, Orange Vendors: IBM, Microsoft, Ping Identity, Layer 7, ForgeRock, Gluu, MITRE, NRI

12. OpenID Connect in Action Client: Salesforce Community Auth Server: Google End User: Me!

13. Salesforce Community Login Page

14. Google Login Page

15. Google Authorization Page

16. Salesforce Community Home Page

17. Questions? Pat Patterson Developer Evangelist Architect salesforce.com @metadaddy