Specify how a federation context is selected in authorization request.

[felix-hellman]

OpenID federation specifies the option to push a trust_chain in the authorization_request.

This leads to large payloads that require a lot of verification logic for the OP.

Would it not be easier for the RP to send a resolve request of where the OP can find the RP?

E.g.
?resolve_uri=https://dev.swedenconnect.se/oidf/resolver/resolve?sub=https://dev.swedenconnect.se/demo/rp&trust_anchor=https://dev.swedenconnect.se/oidf/ta

The OP could then resolve the RP easily. The OP must do some sanity checks but does not need to implement all validation logic.

1. Only perform requests for resolvers it recognises.
2. Only trust responses that are signed with a trusted key (signed by the resolver)

[felix-hellman]

See https://openid.net/specs/openid-federation-1_0.html#section-8.3.1

When resolving an entity the OP should specify ALL trust anchors that should be included in the search