<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-family:Calibri,sans-serif; font-size:11pt">What would the request object form of this request be?<br>
</div>
</div>
<hr>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">From:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">John Bradley</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Sent:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">7/5/2012 6:42 AM</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">To:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">openid-specs-ab@lists.openid.net Group</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Subject:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">[Openid-specs-ab] Requested user alias</span><br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">In talking to a number of people, and looking at account chooser.<br>
<br>
What seems to be required is to send an alias for the user to the IdP requesting that the person be prompted to login to this account.<br>
<br>
The alias may be in email form or something else. <br>
<br>
I think that is different from saying only return a login if the person's email matches this.<br>
<br>
There are two slightly different versions of this.<br>
<br>
One is where the user is defaulted to the account in the hint, but can select another account.<br>
The other is the user is only given the option of authenticating with that account, and can't select another at the IdP.<br>
<br>
I suspect there are use-cases for both, but the second is much harder for the client to depend on, and may introduce risks if the IdP is not compliant.<br>
<br>
I think with account chooser this will be common enough to warrant it being a query parameter rather than in the request object.<br>
<br>
We need to be careful that we don't mislead people into thinking that this is a way to verify an email, as that will go horribly wrong the first time a IdP allows account selection.<br>
<br>
I think we should add a new query parameter for the authorization endpoint "user_alias".<br>
<br>
This is an alias for the account the user wishes to authenticate with. The IdP may display the name sent or some other string, or graphic to prompt the user.<br>
<br>
<br>
As a flow I would expect the RP to send me to account chooser where I select the account I want to use.
<br>
Account chooser sends back something in the form of an email / acct: URI.<br>
<br>
The Client performs discovery on it getting the issuer.<br>
<br>
The portion of the acct: uri before the @ could be a simple name or it could be some other signed object generated by the IdP perhaps containing the user's pre consent to releasing particular attributes, or even an id_token generated dynamically by the IdP
(acct chooser as proxy in implicit flow)<br>
<br>
That object acct:xxx@example.com would then be passed in "user_alias" to the authorization endpoint, where the user would be prompted if they need to enter credentials or other authorization, or not if the user is already authenticated.<br>
<br>
John B.</div>
</span></font>
</body>
</html>