<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Martin Atkins wrote:
<blockquote cite="mid45ABD0DF.9020803@degeneration.co.uk" type="cite">
<pre wrap="">Simon Willison wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 15 Jan 2007, at 08:08, Martin Atkins wrote:
</pre>
<blockquote type="cite">
<pre wrap="">OpenID Exchange[1] is a protocol for doing arbitrary HTTP requests
between two sites where the caller acts on behalf of the user and the
user gives that caller a one-time permission to perform the action.
</pre>
</blockquote>
<pre wrap="">So it's basically a spec for doing with OpenID the kind of things
that Flickr's authentication API does? i.e. a mechanism for letting a
third party application make API calls on your behalf without having
to give them your full authentication details?
<a class="moz-txt-link-freetext" href="http://flickr.com/services/api/auth.spec.html">http://flickr.com/services/api/auth.spec.html</a>
</pre>
</blockquote>
<pre wrap=""><!---->
After having a quick look at that I'd say yes, it is very similar.
They could in theory implement their "login link" thing over OpenID
Exchange, and then proceed as normal with the returned "frob".
However, I'm more interested in generic, multi-platform APIs that allow
a loosely-coupled client and server, however. The "Post to my Weblog"
service is intended so that in theory any random site can post to any
random weblog — regardless of weblog platform[1] — without needing any
pre-existing relationship nor any of this "API Key" nonsense.
</pre>
</blockquote>
I'm very interested in this topic. There are lots of interesting
issues that come up when you want to allow intermediaries as well
(clients which talk to servers which are themselves clients... all of
whom need to have some end user identity information).<br>
<br>
I can't find the reference for OpenID Exchange, though -- is there <br>
<blockquote cite="mid45ABD0DF.9020803@degeneration.co.uk" type="cite">
<pre wrap="">--------
[1] Of course, the weblog platform will need to implement the "Post to
my weblog" protocol!
</pre>
</blockquote>
There is such a protocol, which currently relies on HTTP authentication
schemes because there's nothing both open and standard sitting out
there to use:<br>
<br>
<a class="moz-txt-link-freetext" href="http://bitworking.org/projects/atom/draft-ietf-atompub-protocol-12.html">http://bitworking.org/projects/atom/draft-ietf-atompub-protocol-12.html</a><br>
<br>
Perhaps this is simply a matter of filling in the gaps?<br>
<br>
(Disclosure: I contribute to the Atom WG.)<br>
<br>
<div class="moz-signature">-- <br>
<br>
<a href="http://feeds.feedburner.com/aol/SzHO"><img
src="cid:part1.06090206.07020604@aol.net"
style="border: 0pt none ; float: right;" alt="Abstractioneer"></a>John
Panzer<br>
System Architect<br>
<a class="moz-txt-link-freetext" href="http://abstractioneer.org">http://abstractioneer.org</a><br>
</div>
</body>
</html>