<html><head><base href="x-msg://305/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">To capture what I thought I heard agreement on at the end of the call.<div><br></div><div>The User info endpoint will have a optional parameter.</div><div>Sending the user_id is not required.</div><div><br></div><div>4.3.1 UserInfo Request.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-style-span" style="font-family: 'Bitstream Vera Sans'; font-size: 9px; ">Client MAY send request with following parameters to the UserInfo Endpoint to obtain further information about the user.</span><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 6.5px/normal 'Bitstream Vera Sans'; color: rgb(255, 255, 255); "><b>TOC</b></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 6.5px/normal 'Bitstream Vera Sans'; color: rgb(255, 255, 255); "><b>TOC</b></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span style="font: 6.5px 'Bitstream Vera Sans'; color: #ffffff"><b>TOC</b></span>access_token REQUIRED. The access_token obtained above.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span class="Apple-tab-span" style="white-space:pre"> </span>user_id OPTIONAL. A locally unique and never reassigned identifier for the user. e.g. "24400320" or "AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4". It MUST NOT exceed 255 ASCII characters in length. It could be a pairwise private identifier of the enduser between the Client and the Server.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span class="Apple-tab-span" style="white-space:pre"> </span>fmt OPTIONAL if not included the response may be a proprietary format to support backwards computability. If present the values are:</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span class="Apple-tab-span" style="white-space:pre"> </span>"nor" (normal) an unsigned JSON object containing the openID schema</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span class="Apple-tab-span" style="white-space:pre"> </span>"sig" (signed) the contents are a signed JWT openID schema</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><span class="Apple-tab-span" style="white-space:pre"> </span>Other values may be defined.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">I removed client_id for compatibility with FB. I don't know what it was adding anyway</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">We could list "enc" encrypted as a option, but I don't think it adds anything as a option to the fmt parameter.</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">We could add a fb_graph option to make it clear when people are looking for that. Other providers might want to support it.</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">Are there others we want to list?</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">We need to define an error format in 4.3.3 for when someone asks for an unsupported format. Something like a list of supported formats?</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">So in the Facebook case you would send:</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><a href="https://graph.facebook.com/me?access_token=">https://graph.facebook.com/me?access_token=</a>... To get the Facebook version</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">And</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><a href="https://graph.facebook.com/me?fmt=nor&access_token=">https://graph.facebook.com/me?fmt=nor&access_token=</a>... To get the basic openID user Info schema.</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;">I am expecting some folks to complain about the parameter names wanting "format" instead of "fmt" etc.</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="3"><span class="Apple-style-span" style="background-color: transparent; font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-style-span" style="font-size: 12px;">Facebook includes the user ID in the path rather than as a parameter. I am assuming that for the openID endpoint we want to leave out the user ID and let people add it back in what ever way works with there existing API?</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-style-span" style="font-size: 12px;">Paul, what happens if you do just </span></font><span class="Apple-style-span" style="font-family: Helvetica; font-size: 12px; "><a href="https://graph.facebook.com/?access_token=">https://graph.facebook.com/?access_token=</a>... </span><span class="Apple-style-span" style="font-size: 12px; "> </span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-style-span" style="font-size: 12px;">John B.</span></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 8.5px/normal 'Bitstream Vera Sans'; "><br></div><div><div>On 2011-05-23, at 8:24 PM, Mike Jones wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Paul Tarjan<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Breno de Medeiros<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Marius Scurtescu<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Andrew Wansley<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">John Bradley<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Mike Jones<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">David Recordon<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">We started the call late because the OAuth working group meeting had just finished. All the open OAuth issues were discussed and either resolved or action items were assigned to resolve them. All but John met in person at Facebook. Facebook plans to publish this an OAuth extension.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Paul wants to ship these soon:<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "> display=always, which always forces a user dialog,<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "> display=none, in which there is no user dialog, and user state is sent to the redirect URI in the fragment<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "> user state can be one of {authorized, unauthorized, unknown}<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Breno will write up a response_type=none OAuth extension, which just redirects to the redirect URI without credentials.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Marius wondered if the result should be an error, not a special result<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Facebook has two endpoints: userinfo endpoint and access token inspection endpoint<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Paul wants the token validation endpoint to also be able to accept an access token, returning the access token as a result. Facebook doesn’t currently send an id_token. Breno believes this optimization is necessary. Interop could be achieved by calling the calling the endpoint to get the token that way.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Breno discussed having a static endpoint containing public keys to enable dynamic client registration.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">For anti-spam purposes, Paul doesn’t want dynamic apps to be able be easily created and be spam sources. Breno and John discussed that support for dynamic clients can be optional in the spec. We all agreed that the method for dynamic registration is necessary for an OpenID spec. This work is being deferred until later in the process when the problem is better understood.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">David questioned the adoption of Portable Contacts schemas because it’s not like what Facebook and Live are doing. Breno asked for a concrete counter-proposal. Mike emphasized that the primary decision was not to create a new schema. Breno said that a schema identifier could be passed to the userinfo endpoint to select between data representations. Paul likes format=OpenID when querying userinfo endpoint.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; ">Facebook is using their signed request format documented at<span class="Apple-converted-space"> </span><a href="http://developers.facebook.com/docs/authentication/signed_request/" style="color: blue; text-decoration: underline; ">http://developers.facebook.com/docs/authentication/signed_request/</a><span class="Apple-converted-space"> </span>rather than JWTs at present. They’re worried about the switching cost at present.<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "> -- Mike<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-bottom: 0.0001pt; margin-left: 0in; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></div></blockquote></div><br></div></body></html>