WeftID 1.11 makes WeftID an OpenID Provider. An application can now offer a "Sign in with WeftID" button, much as it might offer "Sign in with Google," and get back a verified user.
Until now, WeftID could only sign users in to applications that speak SAML. This covers established business software. But SAML is not what most app developers prefer to work with today. OIDC is a more targeted and unsurprising contract with strong conventions across the industry. And it is well supported by authentication libraries in every common language.
The lack of OIDC support has been a hole in the feature set of WeftID. Without it, application developers have to implement SAML, negating a significant part of the benefit that WeftID ought to bring to the table.
With this release, the convenient OIDC integration path becomes available.
What it does
Turn OIDC on for an application in the admin UI and it becomes a normal OIDC client. Point any standard library at WeftID's discovery URL, and sign-in works. There is no WeftID-specific code to write, and nothing for the application to store: it receives a signed token identifying the user, their name and email, and the groups they belong to.
Because WeftID sits in the middle, the application does not need to care where the user actually came from. A partner's Okta, a passkey, an invited user with a password: it all arrives at the application as the same signed identity.
Who is allowed in
The addition of OIDC support does not fundamentally change anything. OIDC applications use the exact same access model WeftID already applies to SAML apps. As soon as a group is assigned to an application, members of that group can sign in. Remove someone from a group and their existing sessions stop working.
The app is handed a set of groups and decides what to show. Who is in which group, and who may sign in at all, is administered in WeftID.
Getting it
Enable OIDC on an app under Integrations, copy the discovery URL, and point the application's OIDC library at it. The Sign in with WeftID admin guide has the walkthrough, including the scopes and claims on offer and how to rotate the signing key.
Next is OIDC in the other direction: federating to upstream providers that speak OIDC rather than SAML, and social sign-in on top of it. See the roadmap.