The IDP Kit enables you to launch an OIDC compliant identity provider that utilizes the OIDC-SIOPv2 protocol and/or NFT blockchain APIs to retrieve identity data or NFT metadata via a suitable wallet, providing the data as user info and/or mapping it to standard OIDC claims.
This enables applications, that already support OIDC-based authentication, to connect to SSI, NFT wallets or leverage Sign-in with Ethereum (EIP-4361), where users act as self-issued identity providers, with minimum effort, which in the simplest case could involve nothing more than a configuration change.
The following picture shows a simple OIDC authentication flow between the end user application and the IDP Kit:
The IDP Kit can be configured as a federated identity provider, with other Identity and Access Management systems, such as KeyCloak, as shown in the picture below:
This section elaborates the theory behind the IDP Kit:
IDP Kit Basics - Learn what the IDP Kit is and what it does.
Architecture - Explore the architecture and components.
Feature List - Explore all features in an overview list
Here are the most important things to know about the IDP Kit:
It is open source (Apache 2). You can use the code for free and without limitations.
It is an out-of-the-box solution that you can simply re-use or even white-label such as for building pilot projects quickly.
It is customisable in a sense that you can individualise it based on your requirements.
It is composable in a sense that you can plug your existing (d)apps into the IDP Kit in order to supercharge your (d)apps with SSI capabilities.
It abstracts complexity such as low-level functionality related to key handling, data storage, signing and interactions with third party systems and SSI wallets.
It is built on open standards to ensure interoperability and prevent lock-in effects.
It is flexible in a sense that you can deploy and run an IDP on-premise, in your (multi) cloud environment or directly integrate our libraries.
It enables you to use different identity ecosystems like Europe’s emerging identity ecosystem (EBSI, ESSIF) in anticipation of a multi-ecosystem future. (Consult the to find out which ecosystems the IDP Kit supports.)
The IDP Kit is built on top of the Wallet Kit, providing the SSI credential verification and SIOP protocol logic and the SSI Kit, providing basic functionality with regards to credential and key management, as well as the NFT Kit for verification of NFTs and interaction with blockchain APIs.
It provides APIs for OIDC-clients to connect and initiate user authentication, as well as the SIOP APIs and NFT verification APIs for communication with the SSI and NFT wallets.
The following picture shows the overall architecture of the IDP Kit:
The IDP Kit makes it easy for you to build and launch your own OIDC compliant identity provider utilizing SSI, NFTs or Sign-In with Ethereum to obtain identity data.
Depending on your requirements the IDP Kit can be configured to map data from verifiable credentials or NFTs to standard OIDC claims (e.g. OIDC profile scope), or to deliver the presented credentials, NFTs or account addresses as they are via the custom vp_token and nft_token siwe claims.
The following overview summarizes the basic features of the IDP Kit:
OIDC
Standard OIDC protocol support, when interfacing with end user applications
Support for OIDC scopes like profile, address, email, and standard claims
Support for custom vp_token and nft_token claims, to allow client applications to request credential or nft token data from the user
Support for various OIDC flows, including code flow, implicit flow and hybrid flows
Support for OIDC auto discovery via well-known endpoint for OpenID provider metadata
SSI
Credential presentation exchange with SSI wallets via the OIDC/SIOPv2 protocol
Verification of credential and presentation signatures, challenges and compliance with the presentation request
Pluggability of additional verification policies
Support for custom verification policies
NFTs
NFT metadata exchange with NFT wallets such as MetaMask
Verification of NFT collections and traits
Sign-In with Ethereum
Get account addresses from wallets such as MetaMask
Verify ownership of the address
Claims and claim mapping
Support for mapping credential and NFT data to standard OIDC claims and scopes
Custom vp_token claim to propagate the verified presentation including all required credentials to the end user application as user info
Custom nft_token claim to propagate verified NFT metadata, such as collection membership and token traits, to the end user application as user info
Custom siwe claim to propagate verified addresses to the end user application as user info
Client authentication
Configuration of client IDs, client secrets and redirect uri, to enforce client authentication (via client_secret_basic mode)
Dynamic client registration
Signature types
Support for RS256, EdDSA and ES256K key and signature types, for signing tokens
Publishing of public keys on standard OIDC JWK set endpoint, to enable clients to verify token signatures
