← All practicals

Resolve a trust chain to a pinned anchor

Register a subordinate entity, then watch the resolver verify a chain up to a pinned trust anchor, hop by hop.

1. 1

   On the Federation lab, register a subordinate leaf entity with its own entity id.

   OpenID Federation 1.0: every party in a federation is identified by an entity id and publishes its own signed entity statement — this is how thousands of parties trust each other without a pairwise config for every pair.

2. 2

   Resolve its trust chain.

   The resolver walks authority_hints from your leaf up to a PINNED trust anchor, verifying at EACH hop that the statement is signed by the key its superior published for it — never by what the entity merely claims about itself.

3. 3

   Read the per-hop trace.

   Exactly like the FGA Check trace, every hop shows what was checked and why it passed — the whole point of a resolver is that trust is never a black box.