OpenID Foundation

OpenID Foundation
Randy Reddig (ydnar) [2] · Public domain · source
Name	OpenID Foundation
Formation	2007
Type	Nonprofit organization
Purpose	Authentication standards
Headquarters	San Francisco, California
Region served	Global
Leader title	Executive Director

OpenID Foundation is a nonprofit organization that develops and promotes identity standards for user-centric authentication on the Internet. It coordinates technical workstreams, stewardship, and certification around protocols used by web services, mobile platforms, and enterprise systems. The Foundation engages with standards bodies, vendors, and implementers to harmonize specifications across ecosystems such as social networks, cloud providers, and government identity programs.

History

The Foundation was formed amid concurrent efforts by projects such as OpenID, OAuth, SAML 2.0, Liberty Alliance, and corporate initiatives from Google and Yahoo! to address federated login and decentralized identity. Early catalysts included interoperability events involving Microsoft, VeriSign, PayPal, and the Internet Identity Workshop community alongside academic work from MIT, Stanford University, and Carnegie Mellon University. Milestones trace through interactions with standards organizations like W3C, IETF, OASIS, and the FIDO Alliance while responding to deployments by Facebook, Amazon (company), AOL, Myspace, and government pilots such as projects with US Department of Homeland Security and UK Cabinet Office. The Foundation’s charter evolved in parallel with specifications from Friedrich Ludwig Jahn-era identity experiments (historical identity theory) and later RFC releases from Internet Engineering Task Force working groups influenced by contributors from Apple Inc., Mozilla Foundation, Ericsson, Cisco Systems, and Oracle Corporation.

Governance and Membership

Governance uses a board and working group model shared by corporate sponsors, academic institutions, and individual experts drawn from organizations such as Google, Microsoft, Apple Inc., Facebook, Ping Identity, Okta, Inc., ForgeRock, Auth0, IBM, Intel Corporation, Red Hat, Accenture, and Deloitte. Membership tiers mirror practices used by Linux Foundation and Apache Software Foundation with corporate members, individual members, and academic liaisons from Harvard University, University of California, Berkeley, University of Oxford, ETH Zurich, and University of Cambridge. Oversight mechanisms reference governance practices akin to IEEE Standards Association and coordination with governmental identity programs like eIDAS and agencies such as National Institute of Standards and Technology and European Commission. The Foundation’s board has included representatives formerly associated with PayPal, Salesforce, Siemens, SAP SE, Nokia, and non-commercial advocates from Electronic Frontier Foundation and Open Rights Group.

Standards and Specifications

The organization stewards, publishes, and advances specifications interoperable with technologies from OAuth, JSON Web Token, JWT, JSON Web Signature, JWS, OpenID Connect, WebAuthn, and legacy formats like SAML 2.0. Work items have intersected with drafts and RFCs produced by IETF OAuth Working Group, IETF JOSE Working Group, and contributions cited by W3C WebAuthn Working Group and OASIS XACML Technical Committee. The Foundation defines conformance suites and certification programs similar to PCI Security Standards Council testing frameworks and collaborates on profiles used by Gartner-referenced enterprise directories and cloud identity platforms developed by Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Standards outputs link to implementation guidance used by NIST Digital Identity Guidelines and identity proofing programs in national initiatives like US Federal Identity, Credential, and Access Management.

Implementations and Adoption

Adoption spans consumer services, enterprise identity providers, and open source projects, with implementations in Apache HTTP Server modules, NGINX, Keycloak, Shibboleth, SimpleSAMLphp, and commercial offerings by Okta, Inc., Ping Identity, ForgeRock, Auth0. Major platform integration includes Android (operating system), iOS, Windows, and macOS, and cloud services from Amazon Web Services, Microsoft Azure, Google Cloud Platform, and IBM Cloud. Identity federations and ecosystem players such as InCommon, eduGAIN, GLUU, Salesforce, GitHub, LinkedIn, Dropbox (service), Box (company), Slack Technologies, and Atlassian have incorporated compatible flows. Academic deployments at University of California, Berkeley, MIT, Stanford University, and University of Cambridge have driven research integrations used in MOOCs hosted by Coursera, edX, and Udacity.

Security and Privacy

Security posture builds on cryptographic standards developed by communities around IETF, W3C, and FIDO Alliance with implementations leveraging RSA (cryptosystem), Elliptic-curve cryptography, HMAC, and X.509 certificates. Threat modeling references incident analyses comparable to breaches experienced by Yahoo!, Equifax, LinkedIn, Target Corporation, and mitigations are informed by guidance from National Institute of Standards and Technology, ENISA, CERT Coordination Center, and privacy frameworks like General Data Protection Regulation and California Consumer Privacy Act. Privacy engineering practices mirror approaches advocated by Mozilla Foundation, Electronic Frontier Foundation, and academic centers such as Center for Internet and Society and Harvard Berkman Klein Center. Conformance and certification programs include testing for replay attacks, token theft, CSRF, and phasing out insecure flows to align with recommendations by IETF OAuth Working Group and W3C WebAuthn.

Events and Outreach

The Foundation organizes workshops, interoperability events, and collaborates with conferences like RSA Conference, Black Hat USA, Internet Identity Workshop, Identiverse, Krebs on Security-adjacent forums, and academic symposia at USENIX Security Symposium, IEEE Symposium on Security and Privacy, and ACM CCS. Outreach includes liaison activity with W3C, IETF, OASIS, FIDO Alliance, and regional identity fora in Europe, Asia-Pacific, and Latin America working with national bodies such as Gov.uk Verify-related teams, DAJIE-style platforms (China), and public sector identity programs in Australia and Canada. Training, certification, and community engagement are supported through collaborations with vendor conferences hosted by Microsoft Ignite, Google Cloud Next, AWS re:Invent, and partner meetups involving GitHub Universe and DevOpsDays.

Category:Identity management