Full SA implementation

[eduperottoni]

Hey, I have some questions regarding the Full SA entity (described here) for OpenID Federation.
I really think this entity is important for building federations using OpenID Federation, specially when it comes to adoption of OIDC RPs that don't implement federation specific features.

1. At first, I didn't find any other documentation describing the requirements and characteristics of this aggregator in a deeper and technical way, is there any?

2. Is there any reference implementation of the Full SA for OpenID Federation?

Thanks so far!

[eduperottoni]

@peppelinux is there an answer for this question?

[peppelinux]

Hi @eduperottoni, sorry forthe late reply

Full SA is an IAM Proxy implementing on bahelf of its subordinates the trust protocol and endpoints according to openid federation, to offload implementative efforts to its subordinates.

OpenID Federation doesn't enter in this kind of implementative details, if I may answer to any of your questions please ask

[eduperottoni]

Hey, @peppelinux! Thanks for replying...

I was searching for implementations of this proxy after I read the proposal at https://italia.github.io/spid-cie-oidc-docs/en/soggetti_aggregatori.html.

I saw you have the iam-proxy-italia (https://github.com/italia/iam-proxy-italia/tree/master) project, and it has a SATOSA backend which uses the OpenID Federation protocol as one of the ways to build trust. But I didn't find any other documentation explaining whether it could be used as a Full SA in an OID federation.

At the proposal, for example, it's said that the Full SA must expose the Entity Configuration for each of its subordinates, so this backend should expose many /.well-known/openid-federation endpoints, which is not the case of iam-proxy-italia, if I remember. Another feature I consider important is the onboarding of new RP in the Full SA during execution time, which I also think is not the case of iam-proxy-italia, which builds the endpoints from the backend configuration_ file.

Is my analysis correct or am I missing something?