@oidfed/authority

Trust Anchor and Intermediate Authority operations — subordinate management, statement issuance, federation endpoint serving, and policy enforcement for OpenID Federation 1.0 deployments.

Targets the final OpenID Federation 1.0 specification and its successor specifications:

• OpenID Federation 1.1 (protocol-independent layer)
• OpenID Federation for OpenID Connect 1.1 (protocol-specific layer)
• OpenID Federation Extended Subordinate Listing 1.0 (tracks draft-02)

Install

Choose the command for your preferred JavaScript package manager or runtime:

# npm
npm install @oidfed/core @oidfed/authority

# pnpm
pnpm add @oidfed/core @oidfed/authority

# yarn
yarn add @oidfed/core @oidfed/authority

# bun
bun add @oidfed/core @oidfed/authority

# Deno (Deno 2.0+ / JSR/npm specifier auto-resolution)
deno add npm:@oidfed/core npm:@oidfed/authority

Quick Start

import { TrustAnchor, MemoryStorageAdapter } from "@oidfed/authority";
import {
  createFederationSigningKey,
  generateSigningKey,
  MemoryFederationKeyProvider,
} from "@oidfed/core";

const signingKey = await generateSigningKey("ES256");
const keyProvider = new MemoryFederationKeyProvider(
  createFederationSigningKey(signingKey.privateKey),
);

const ta = new TrustAnchor({
  entityId: "https://ta.example.org",
  keyProvider,
  metadata: {
    federation_entity: {
      federation_fetch_endpoint: "https://ta.example.org/federation_fetch",
      federation_list_endpoint: "https://ta.example.org/federation_list",
      federation_extended_list_endpoint: "https://ta.example.org/federation_extended_list",
    },
  },
  storage: new MemoryStorageAdapter(),
});

// Serve requests directly with fetch-compatible handleRequest:
const response = await ta.handleRequest(request);

Authority entities require a federation key provider with lifecycle support. Use FederationKeyLifecycleProvider when plugging in KMS-backed or database-backed rollover; MemoryFederationKeyProvider is the in-memory implementation shown above.

Federation endpoint private_key_jwt authentication uses AuthorityConfig.clientKeyProvider to resolve a caller's public Federation Entity Keys. Omit it to use the default subordinate-storage lookup: storage.subordinates.get(entityId)?.jwks.

HTTP routes follow the URLs advertised in metadata.federation_entity. The Entity Configuration route is derived from the configured Entity Identifier path, and fetch/list/optional federation endpoints are served on the advertised endpoint URL paths.

Documentation

For a detailed API reference, subordinate management APIs, and unified storage adapter setups, see the docs/packages/authority.md file.

License

Apache-2.0 — see NOTICE for attribution.