Overview
ISO/IEC 26132:2024 - Information technology - OpenID Connect - OpenID Connect discovery 1.0 incorporating errata set 2 standardizes how a Relying Party (RP) locates and retrieves configuration for an OpenID Provider (OP). Built on OpenID Connect 1.0 and OAuth 2.0, the specification defines issuer discovery using WebFinger and the retrieval of OP metadata from a well-known JSON configuration document. The goal is interoperable, REST-like identity verification and profile discovery for single sign-on and federated identity scenarios.
Key topics and technical requirements
- Issuer discovery (optional): RPs MAY skip discovery if the OP issuer is known out-of-band; otherwise discovery is performed via WebFinger (RFC7033).
- Identifier normalization: User-supplied identifiers (URLs, email-like strings, host:port) are normalized into a WebFinger Resource and Host using rules that handle acct: and https prefixes and strip URI fragments.
- WebFinger usage: RPs make HTTPS GET requests to the Host’s /.well-known/webfinger endpoint with the
resource parameter (and RECOMMENDED rel = http://openid.net/specs/connect/1.0/issuer) to obtain the OP Issuer location.
- OP metadata retrieval: Once an Issuer URI is discovered, RP obtains OP configuration from a well-known location as a JSON document (includes OAuth 2.0 endpoint locations and supported capabilities).
- Security and transport: All WebFinger and metadata communication MUST use TLS as defined in the standard (see Section 7.1). CORS support is recommended for browser-based clients.
- Machine-readable formats: Responses use JSON/JRD per RFC8259 and related IETF specs; JWS/JWE compact serializations are referenced for cryptographic payloads.
- Conformance language: Key requirements use RFC2119 keywords (MUST, SHOULD, RECOMMENDED) to indicate normative behavior.
Practical applications and who uses it
- Identity and access management teams implementing OpenID Connect SSO.
- Application developers and API integrators building Relying Parties that need dynamic OP discovery and configuration.
- Identity providers (OPs) publishing discoverable endpoints and metadata for federation.
- Security architects designing secure authentication flows that rely on standardized issuer discovery and metadata validation.
- Browser-based or JavaScript clients requiring CORS-accessible discovery endpoints for seamless sign-on.
Related standards
- OpenID Connect Core 1.0 (core protocol and claims)
- OAuth 2.0 (RFC 6749) - authorization framework
- WebFinger (RFC 7033) - resource discovery mechanism
- acct URI (RFC 7565), URI syntax (RFC 3986), JSON (RFC 8259)
- RFC 2119 - requirements language
Keywords: ISO/IEC 26132:2024, OpenID Connect Discovery, OpenID Provider discovery, WebFinger, OAuth 2.0, RP metadata, .well-known, issuer discovery, JSON configuration, TLS.