papers/lux-id-iam/sections/03-multi-protocol-support.tex

\section{Multi-Protocol Support}


\subsection{OAuth 2.0 Implementation}

Lux.id implements the complete OAuth 2.0 specification (RFC 6749) with support for all standard grant types:

\subsubsection{Authorization Code Flow}

The authorization code flow follows the standard OAuth 2.0 sequence:

\begin{figure}[h]
\centering
\begin{tikzpicture}[node distance=2cm]
    \node (client) [rectangle, draw] {Client};
    \node (browser) [rectangle, draw, right of=client, xshift=2cm] {Browser};
    \node (luxid) [rectangle, draw, right of=browser, xshift=2cm] {Lux.id};
    \node (resource) [rectangle, draw, right of=luxid, xshift=2cm] {Resource};

    \draw[->] (client) -- (browser) node[midway, above] {1. Redirect};
    \draw[->] (browser) -- (luxid) node[midway, above] {2. Authorize};
    \draw[->] (luxid) -- (browser) node[midway, below] {3. Code};
    \draw[->] (browser) -- (client) node[midway, below] {4. Code};
    \draw[->] (client) to[bend left=45] (luxid) node[midway, above] {5. Exchange};
    \draw[->] (luxid) to[bend left=45] (client) node[midway, below] {6. Token};
    \draw[->] (client) -- (resource) node[midway, above] {7. Access};
\end{tikzpicture}
\caption{OAuth 2.0 Authorization Code Flow}
\end{figure}

\subsubsection{PKCE Enhancement}

For public clients, we implement Proof Key for Code Exchange (RFC 7636):

\begin{equation}
    \text{challenge} = \text{BASE64URL}(\text{SHA256}(\text{verifier}))
\end{equation}

This prevents authorization code interception attacks in mobile and single-page applications.

\subsubsection{Token Management}

Access tokens use JWT format with custom claims:

\begin{lstlisting}[language=json]
{
  "iss": "https://id.lux.network",
  "sub": "user:123",
  "aud": "app:trading",
  "exp": 1735689600,
  "iat": 1735686000,
  "scope": "read:portfolio write:orders",
  "wallet": "0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb",
  "did": "did:lux:1234567890abcdef"
}
\end{lstlisting}

\subsection{OpenID Connect (OIDC)}

Built atop OAuth 2.0, our OIDC implementation adds identity layer capabilities:

\subsubsection{ID Token Structure}

ID tokens contain authenticated identity claims:

\begin{equation}
    \text{ID Token} = \text{Header}.\text{Claims}.\text{Signature}
\end{equation}

Where claims include standard OIDC attributes plus blockchain-specific fields:

\begin{itemize}
    \item \texttt{wallet\_addresses}: Array of connected blockchain addresses
    \item \texttt{ens\_name}: Ethereum Name Service identifier
    \item \texttt{nft\_holdings}: Relevant NFT collections for access control
    \item \texttt{reputation\_score}: On-chain reputation metrics
\end{itemize}

\subsubsection{Discovery and Dynamic Registration}

Lux.id exposes standard OIDC discovery endpoint:

\begin{lstlisting}
GET /.well-known/openid-configuration

{
  "issuer": "https://id.lux.network",
  "authorization_endpoint": "https://id.lux.network/oauth/authorize",
  "token_endpoint": "https://id.lux.network/oauth/token",
  "userinfo_endpoint": "https://id.lux.network/oauth/userinfo",
  "jwks_uri": "https://id.lux.network/.well-known/jwks.json",
  "supported_claims": ["sub", "name", "email", "wallet", "did"]
}
\end{lstlisting}

\subsection{SAML 2.0}

For enterprise integration, Lux.id implements SAML 2.0 with support for:

\subsubsection{Assertion Structure}

SAML assertions include both standard and custom attributes:

\begin{lstlisting}[language=xml]
<saml:Assertion>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
      [email protected]
    </saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="wallet">
      <saml:AttributeValue>0x742d35Cc...</saml:AttributeValue>
    </saml:Attribute>
    <saml:Attribute Name="role">
      <saml:AttributeValue>validator</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>
\end{lstlisting}

\subsubsection{Signature Verification}

All assertions are signed using XML Digital Signature:

\begin{equation}
    \text{Signature} = \text{RSA-SHA256}(\text{Canonicalized}(\text{Assertion}), \text{PrivateKey})
\end{equation}

\subsection{LDAP/Active Directory Integration}

Lux.id provides LDAP server functionality for legacy system integration:

\begin{lstlisting}
# LDAP Search Example
ldapsearch -x -H ldap://id.lux.network:389 \
  -D "cn=admin,dc=lux,dc=network" \
  -W -b "dc=lux,dc=network" \
  "(objectClass=person)"
\end{lstlisting}

The LDAP schema is extended with blockchain attributes:

\begin{lstlisting}
attributetype ( 1.3.6.1.4.1.12345.1.1
  NAME 'luxWalletAddress'
  DESC 'Blockchain wallet address'
  EQUALITY caseIgnoreMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
\end{lstlisting}

\subsection{RADIUS Protocol}

For network access authentication, Lux.id implements RADIUS (RFC 2865):

\begin{equation}
    \text{Response} = \text{MD5}(\text{Code} || \text{ID} || \text{Length} || \text{RequestAuth} || \text{Attributes} || \text{Secret})
\end{equation}

This enables blockchain-authenticated network access for validators and infrastructure.