I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more complex than just authenticating a simple server. I've come up with a rough idea of how it could work but I don't know if I've got it right.

For example, user [email protected] wants to log in to server z.com. Let A denote the client computer and a.com A's "homeserver".

Initially, A logs in to a.com using a username and password. When A wants to log in to z.com, it sends a message like "hello I'm [email protected]". Server z.com then contacts a.com, asking for a token (some unique unguessable bytes) which a.com also sends to A. Then A sends the token it was sent to z.com also, and z.com checks that the tokens match. This way, z.com knows that A is authenticated with a.com without needing to know the password.

What are the problems with this approach? How can I learn more about how federation is done in practice?

1 Answer 1


This is what the original OpenID wanted to do.

And it’s basically how Kerberos works with its tickets.

Problem 1: identification, how does z.com verify [email protected] is actually A, and not A’ pretending to be A? Or A@a’.com pretending to be [email protected].

Problem 2: authorization, all you get is a claim (or stake) that the user is [email protected] but we have no way of knowing if A has any authorization for z.com at all. Or even what authorizations A has on a.com

Problem 3: integrity, your scheme has no mechanism to protect the exchange from getting tempered with. What prevents someone from adding claims to their loving they should not have?

Study suggestion: I would read up on OpenID Connect, and its authorization protocol oAuth 2. OIDC has the concept of “Relay Partner” where a service like z.com could relay its authentication to a.com.

As for federation, I suggest reading up on how the fediverse works and how protocols like Matrix are designed.

  • Thanks for the answer. I'm not quite sure what you mean by problem 3, specifically the line "What prevents someone from adding claims to their loving they should not have?". Can you clarify that please?
    – Jachdich
    Sep 7 at 23:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .