Building a National-Scale IdP: Shortcomings of OIDC

Abstract

This presentation reports on the implementation of Brazil's Civil Registry Digital Identity (IdRC), serving potentially over 200 million users, and analyzes practical shortcomings of OpenID Connect (OIDC) in this context. We identify gaps in assurance representation, authentication context preservation, and the expression of authentication requirements. To address these issues, we propose OpenID Connect for Authentication Context (OIDC4AC), a backward-compatible extension that introduces structured authentication context and declarative factor negotiation, improving auditability, interoperability, and policy alignment for large-scale identity infrastructures.