You are here: Foswiki>TIG Web>AccountsAndSecurity>OIDC (revision 2)EditAttach

OpenID? Connect at CSAIL

If you've been around MIT - more especially at CSAIL - for a while, you have probably become accustomed to using "web certificates" as a way to log yourself into the various Web-based applications around campus, like Atlas, Peeps, and many other popular sites. MIT adopted the use of web certificates in 1996 to allow its community a way to log into many different sites without having to remember a username and password for each site.

Fast forward a decade or so, and a new kind of central login method was adopted at MIT: Touchstone, which not only allowed users to use web certificates, but also allowed them to use their Athena username and password, or even existing Kerberos tickets (see for more info).

Fast forward another decade, and CSAIL has begun the adoption of the next generation login system: OpenID? Connect, or OIDC. MIT central campus also has a pilot program for OIDC; however, they are less motivated to get it integrated into campus applications because they already have Touchstone. CSAIL is highly motivated to roll our OIDC because in the very near future, major web browser vendors like Mozilla and Google will end support for web certificate authentication in their browsers. In fact, OIDC at CSAIL will be replacing web certificates entirely for client authentication.

What is OpenID? Connect?

There's a technical description of OIDC you can read at if you want to know all the details, but in short, OIDC is a service that we run at CSAIL on our own servers that allows you to authenticate to services like WebDNS, DHREG, the CSAIL website, and many more, by using your CSAIL Kerberos account.

The short video below shows how you would interact with OpenID? Connect to authenticate to a CSAIL website ( - note that this is a testing system and is not currently meant for production use).

You'll notice that the following happens in the video above:

That's pretty much all you need to do on a day to day basis. Note that you will no longer need to obtain certificates every year or worry about which one(s) you have in your browser. You can also use pretty much all the modern browsers.

-- MarkPearrow - 19 May 2017
Topic attachments
I Attachment Action Size Date Who Comment
May_2_OIDC_presentation.key.pdfpdf May_2_OIDC_presentation.key.pdf manage 129.4 K 02 May 2016 - 21:29 UnknownUser  
firefox-negotiate.pngpng firefox-negotiate.png manage 28.9 K 05 Oct 2017 - 02:46 UnknownUser  
Edit | Attach | Print version | History: r11 | r4 < r3 < r2 < r1 | Backlinks | View wiki text | Edit WikiText | More topic actions...
Topic revision: 28 Jul 2017, MarkPearrow

MIT Computer Science and Artificial Intelligence Laboratory


  • About CSAIL
  • Research
  • News + Events
  • Resources
  • People

This site is powered by Foswiki MIT: Massachusetts Institute of Technology