One of the sure signs of adoption momentum is when other standards organizations, particularly those not typically involved in online identity, implement OpenID Connect and leverage self certification throughout their networks. A new member, Cal Heldenbrand shared the context for a new deployment and the value of self certification in his notes below:
The Real Estate Standards Organization (RESO) is tasked with the difficult goal of standardizing all of the real estate data in the US and Canada. This includes the data payload, the fields, formats, transport mechanism, and authentication/authorization. This is effectively called the Real Estate Transaction System (RETS). RETS is a 16 year-old standard based on XML, and every real estate website uses it.
The world has changed quite a bit since 1999, and we needed something new and easy to use. Mobile friendly, and developer friendly. The initial learning curve for RETS can be a little daunting, and we want to attract new software companies and developers to our industry. We’ve created the RESO RETS Web API to make life a little easier in the real estate sector. The data transport is using OData V4. On the auth side, we started using OAuth2 around January 2014. At that time, OpenID Connect was very cool looking, but I was hesitant to recommend it to RESO until it was a fully finalized, ratified standard.
There are hundreds of software companies working together in our industry. Writing an interoperable OAuth2 protocol using the framework was difficult. Since there is no OAuth2 standard, it seems like every major installation in the world has their own spin on it. That’s bad. It also meant that I couldn’t just copy how someone else did it, I had to make our own.
Plus, the absence of endpoint metadata means we have to document where everything lives, then ask clients to hard code URLs for every OAuth2 provider. It’s a lot of busywork for a developer to add a new IdP to a software installation.
After OpenID Connect became a finalized standard, I gave a presentation to RESO showing how one website in our industry could accept identities from Google, Microsoft, Amazon, and also from our own OpenID Connect Provider, Spark Platform. Since it’s an actual protocol standard, we could simply plug in IdPs with a small configuration change, and the OpenID Connect client libraries would handle the rest. That’s really powerful. We’re used to SSO integrations taking weeks to complete. With OpenID Connect, that turns into minutes.
One suggestion I do have though — I’d like to see the Discovery specification be part of the required Core. It’s such a simple piece to write, and very integral in the grand scheme of what makes OpenID Connect easy to use.
The certification process was pretty easy as well. I was expecting it to be more intensive! Our environment is Ruby on Rails, and I used Nov’s openid_connect Ruby gem for constructing ID Tokens. Other than that, my Provider is written from scratch. It took me about 2 weeks to have a very simple provider running for demo purposes. Then another 2 weeks to have it fully compliant with the certification tools. This is also along side my usual day job tasks of web operations. I’d have to say this was a breeze compared to the old OpenID 2.0.
Thanks for making a great standard!”
And thanks to Cal and the Real Estate Standards Organization (RESO) team for sharing their use case and feedback.
The OpenID Foundation