@oidfed/leaf

Leaf Entity toolkit — Entity Configuration serving, authority discovery, and trust chain participation for any entity at the edge of an OpenID Federation.

Targets the final OpenID Federation 1.0 specification and its successor specifications:

• OpenID Federation 1.1 (protocol-independent layer)
• OpenID Federation for OpenID Connect 1.1 (protocol-specific layer)

Install

Choose the command for your preferred JavaScript package manager or runtime:

# npm
npm install @oidfed/core @oidfed/leaf

# pnpm
pnpm add @oidfed/core @oidfed/leaf

# yarn
yarn add @oidfed/core @oidfed/leaf

# bun
bun add @oidfed/core @oidfed/leaf

# Deno (Deno 2.0+ / JSR/npm specifier auto-resolution)
deno add npm:@oidfed/core npm:@oidfed/leaf

Quick Start

import { Leaf } from "@oidfed/leaf";
import { OidcRelyingPartyRole, StaticProtocolSigningKeyProvider } from "@oidfed/oidc";
import {
  createFederationSigningKey,
  JwkSigner,
  MemoryFederationKeyProvider,
} from "@oidfed/core";

const leaf = new Leaf({
  entityId: "https://rp.example.com",
  authorityHints: ["https://federation.example.org"],
  keyProvider: new MemoryFederationKeyProvider(
    createFederationSigningKey(myFederationSigningKey),
  ),
  metadata: {
    federation_entity: {
      organization_name: "My Relying Party",
    },
  },
  roles: [
    new OidcRelyingPartyRole({
      protocolKeyProvider: new StaticProtocolSigningKeyProvider({
        requestObjectSigner: new JwkSigner(myProtocolSigningKey),
      }),
      metadata: {
        redirect_uris: ["https://rp.example.com/callback"],
        response_types: ["code"],
        client_registration_types: ["automatic"],
        jwks: { keys: [protocolPublicKey] },
      },
    })
  ]
});

// Serve the request directly using a fetch-compatible interface:
const response = await leaf.handleRequest(request);

Leaf accepts the read-only FederationKeyProvider contract because it only needs the current federation signer and published Federation JWKS. The in-memory provider used above also supports lifecycle operations, but leaf code does not depend on those methods.

Documentation

For a detailed API reference, entity configuration setups, and authority discovery guides, see the docs/packages/leaf.md file.

License

Apache-2.0 — see NOTICE for attribution.