🌐 OpenID Federation
How do thousands of parties trust each other without pairwise config? Every party publishes a signed entity statement; an authority publishes a signed statement ABOUT each subordinate below it; a resolver walks that chain up to a pinned trust anchor, verifying every hop's signature along the way.
Honest simulation — read this first
In production, the trust anchor, every intermediate, and every leaf hold independent signing keys. This sandbox has no second party to run, so every statement below — the Lab's own entity configuration, the Lab vouching for a leaf you register, and the pinned anchor's simulated statement about the Lab — is minted with the Lab's own key, exactly like the federated login lab's simulated IdP. What's fully real: the resolver performs a genuine signature check at every hop, threading the key each entity's superior published for it through the chain — tamper with, expire, or misdirect any one hop and the chain breaks exactly as it would with independent keys.
The Lab's own Entity Configuration
GET /.well-known/openid-federation — a signed, self-issued statement about the Lab itself.
1. Register a subordinate leaf
Give it an entity id (a URL — its identifier in the federation namespace, globally unique). Its federation key is assigned by the Lab (see the disclosure above) — you'll see it below once registered.
Your registered entities
2. Resolve a trust chain
Walks authority_hints from the entity up to the pinned trust anchor, verifying every hop's signature along the way, and shows the decision plus a per-hop trace.