[OpenID] OpenID Exchange
Martin Atkins
mart at degeneration.co.uk
Mon Jan 15 08:08:34 UTC 2007
Dick Hardt wrote:
> Hi Martin
>
> What would you want OpenID Exchange to do that was not in OpenID
> Attribute Exchange?
>
As I understand it, Attribute Exchange is a mechanism for exchanging
sets of key-value pairs between parties, like "Simple Registration"
taken to its logical conclusion.
OpenID Exchange[1] is a protocol for doing arbitrary HTTP requests
between two sites where the caller acts on behalf of the user and the
user gives that caller a one-time permission to perform the action.
So the two aren't really comparable except to say that Attribute
Exchange could, in theory, use OpenID Exchange as a transport. I see
that right now it's using OpenID Authentication as a transport, but I
assume that this means that I cannot separate my "attribute provider"
from my authentication provider.
OpenID Exchange can operate both standalone and as an OpenID
Authentication Extension, although admittedly right now the
Authentication Extension mode is underspecified and untested because
I've been focusing on the "Post In My Weblog" protocol which makes no
sense to bundle over an Authentication request.
I've intentionally avoided stepping on your toes by speccing anything
for profile exchange over OpenID Exchange so far.
-----------------------------------------
[1] I apologise for the "name collision" with them both having
"Exchange" in the name; I've had this all lying around on my system here
with the name "OpenID Exchange" since not long after I proposed its
predecessor "user-accompanied RPC protocol", so I stuck with the name
when I published it despite the fact that it now collides. Suggestions
for alternative names that aren't horrifically verbose are welcomed.
More information about the general
mailing list