Inmor Trust Anchor Documentation
Inmor is a Trust Anchor (TA) implementation for OpenID Federation 1.0. It provides a complete solution for managing OpenID Federation trust chains, subordinate entities, and trust marks.
The system consists of two components:
Trust Anchor (Rust): High-performance federation server handling entity statements, trust marks, and resolution
Collection CLI (Rust):
inmor-collectiontool that walks federation trees and populates the collection endpoint dataAdmin Portal (Python/Django): REST API for managing subordinates, trust mark types, and trust marks
Note
Inmor is currently under active development and is not yet production-ready.
Danger
Production Security: The Admin API must be protected with authentication (at minimum HTTP Basic Auth) before exposing to any network. See Securing the Admin API for details.
Quick Start
The fastest way to get Inmor running is with Docker Compose:
# Clone the repository (includes signing keys for development)
git clone https://github.com/SUNET/inmor.git
cd inmor
# Build and start all services
just build
just build-rs
just up
# Initialize the Trust Anchor
curl -X POST http://localhost:8000/api/v1/server/entity
curl -X POST http://localhost:8000/api/v1/server/historical_keys
The repository includes development signing keys, so no key generation is needed for getting started. For production, you should generate your own keys.
For detailed instructions, see Installation.
Documentation Contents
Getting Started
API Reference
Configuration
User Guides
- Admin UI Guide
- Multi-Factor Authentication (MFA)
- API Key Authentication
- Trust Mark Management
- Understanding Trust Marks
- Creating Trust Mark Types
- Issuing Trust Marks
- Viewing Trust Marks
- Renewing Trust Marks
- Revoking Trust Marks
- Updating Trust Mark Claims
- Verifying Trust Marks
- Listing Trust Mark Holders
- Trust Marks for the Trust Anchor
- Trusted Trust Mark Issuers (Federation Recognition)
- Best Practices
- Workflow Example
- Subordinate Management
- Understanding Subordinates
- Prerequisites
- Registering a Subordinate
- Viewing Subordinates
- Updating Subordinates
- Disabling Subordinates
- Subordinate Statement Structure
- Fetching Subordinate Statements
- Resolving Trust Chains
- Entity Types
- Metadata Policy
- Renewing Subordinates
- Workflow Example
- Troubleshooting
- Management Commands
Architecture Overview
┌─────────────────────────────────────────────────────────────────┐
│ External Clients │
│ (Federation Entities, RPs, OPs) │
└─────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ Reverse Proxy (nginx) │
│ TLS Termination │
└─────────────────────────────────────────────────────────────────┘
│ │
▼ ▼
┌─────────────────────┐ ┌─────────────────────────┐
│ Trust Anchor │ │ Admin Portal │
│ (Rust/Actix) │◄──────────────►│ (Django/Ninja) │
│ Port 8080 │ Redis │ Port 8000 │
└─────────────────────┘ └─────────────────────────┘
│ │
▼ ▼
┌─────────────────────┐ ┌─────────────────────────┐
│ Redis │ │ PostgreSQL │
│ Federation Cache │ │ Persistent Storage │
└─────────────────────┘ └─────────────────────────┘
OpenID Federation Compliance
Inmor implements the following OpenID Federation endpoints:
/.well-known/openid-federation- Entity configuration/fetch- Fetch subordinate statements/list- List subordinates/resolve- Resolve trust chains/trust_mark- Get trust marks/trust_mark_list- List entities with trust marks/trust_mark_status- Validate trust marks/historical_keys- Historical/expired key set/collection- Entity collection (populated byinmor-collectionCLI)