<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Simon Willison wrote:
<blockquote
cite="mida3b4f3b60703071542s23817bc6ve90e268d857e0d7f@mail.gmail.com"
type="cite">
<pre wrap="">On 3/7/07, Martin Atkins <a class="moz-txt-link-rfc2396E" href="mailto:mart@degeneration.co.uk"><mart@degeneration.co.uk></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I created this page on the wiki ages ago but never really did much to
promote it. I just added a few more items of my own, and restructured it
a little bit:
<a class="moz-txt-link-rfc2396E" href="http://openid.net/wiki/index.php/Relying_Party_Best_Practices"><http://openid.net/wiki/index.php/Relying_Party_Best_Practices></a>
My thinking is that we could produce a bunch of best practices organised
into different "quality levels", which would hopefully cause sites to
aim towards maximum quality wherever possible, while making it clear
which things are pretty-much required for any kind of useful
implementation and which are just "would-be-nice" requirements.
</pre>
</blockquote>
<pre wrap=""><!---->
That's a really great list. I have one query about it:
- Many-to-one relationship between Identity URLs and "user accounts"
- Don't require users to choose locally-unique usernames
These appear to be conflicting recommendations. For the second one,
you advocate using the OpenID identifier as the primary identifier for
a user, but in the first you emphasize that a user account should be
able to have more than one OpenID associated with it. Even if you ask
the user to select their "primary" OpenID you still run in to problems
should they later ditch that one in favour of another. This could
definitely be clarified.
</pre>
</blockquote>
If you assume that the local user account need not have a local
username (perhaps just an autogenerated UID), does this resolve the
problem?<br>
<br>
OpenID1 --> UID1<br>
OpenID2 --> UID1<br>
<br>
No local user name, yet they can ditch OpenID1 without affecting
OpenID2.<br>
<br>
Also:<br>
<br>
"<i>[TODO: Perhaps define a rel="..." keyword for OpenID identifiers,
so that interested software can grovel for them?]"</i><br>
<br>
I think that the hCard microformat handles this nicely, using "uid":<br>
<br>
<span class="vcard"><a class="url fn uid"
href=<a class="moz-txt-link-rfc2396E" href="http://john.example.com">"http://john.example.com"</a>>John Bloggs</a></span><br>
<br>
(Per related discussions on microformats-discuss mailing list.)<br>
<br>
I really like this page. I wonder if it's appropriate to start
documenting "commonly used attributes" in which RPs are commonly
interested ? (Nickname, website, email...)<br>
<br>
Regards,<br>
John Panzer<br>
<br>
</body>
</html>