Only the safe flows
Authorization code with PKCE for every application with a user, client credentials for services. The implicit flow and the password grant are not available, so they cannot be misused.
Security
Security is the product
An identity service holds the keys to every application behind it. OneiD is built so that the safe choice is the default and the unsafe one is not on offer.
Controls
What OneiD does to protect you
Each of these is part of OneiD as it ships, not an option you have to find.
Signing keys under control
RSA keys stored encrypted, rotated from the console and published before they sign. Retired keys stay published long enough for issued tokens to remain verifiable.
Secrets encrypted at rest
Signing keys, authenticator secrets and session cookies are protected by an encrypted key ring. Passwords are stored only as salted, deliberately slow hashes, or not at all when a directory checks them.
Multi-factor authentication
Authenticator-app codes with QR enrolment, optional or mandatory. Replayed codes are refused, and turning the factor off needs proof and sends an email.
Brute-force protection
Accounts lock after repeated wrong passwords or codes, and rate limits apply per address and per account to sign-in, second factors, password recovery and the token endpoint.
Answers that reveal nothing
A failed sign-in gives the same answer whether the account is unknown or locked, so attackers cannot probe for accounts.
Revocation when it matters
Tokens are revoked when a user signs out of an application, changes the password, loses a role, is locked, or when a client is disabled.
Least privilege for administrators
Separate administrator roles, read-only versions, and privileged scopes that only a full administrator can grant.
Strict in the browser
HTTPS only with HSTS, a Content-Security-Policy with per-request nonces, no framing, no referrer, CSRF protection, and sign-out by POST only.
Audit log
Sign-ins, failures, second factors, password and role changes, client changes and key rotations are recorded with time and address.
No secrets in logs
Logs never contain passwords, secrets or tokens, and identifiers are masked. Client secrets can carry an expiry date that OneiD enforces.
Tested against the standard
The OpenID Foundation’s conformance suite ran the Config, Basic, Form Post and RP-Initiated Logout provider plans with no failed test.
Certifications
We will not claim a certificate before we have it
OneiD was tested with the OpenID Foundation’s conformance suite. These are the certifications we are working towards.
OpenID Certified (OpenID Foundation, provider profiles)Planned
Shared responsibility
Who does what
OneiD
- Protocol behaviour that follows OpenID Connect and OAuth 2.0
- Secure defaults: PKCE, rotating refresh tokens, short-lived codes
- Encryption of keys and secrets at rest
- Lockout, rate limits and the audit log
- Security fixes in OneiD releases
- When we host OneiD: updates, backups and monitoring
You and your applications
- Keep client secrets on servers only, in a secret store, and plan secret replacement (a new secret applies at once).
- Register exact redirect addresses, on https.
- Validate ID tokens and access tokens: signature, issuer, expiry and scope.
- Store refresh tokens safely and always keep the newest one.
- Make the second factor mandatory for administrators and sensitive applications.
- Review the audit log and remove access that people no longer need.
Found a security problem?
Tell us privately through the contact form, with the steps to reproduce it. Please do not test against other people’s accounts or data. Our contact details are also insecurity.txt.
Ask us the hard questions
Security reviews are welcome. Tell us what your assessment needs and we will walk your team through how OneiD works.