<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Ad-hoc conversation about i-names and OpenID Connect Migration 29-Aug-14<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Markus Sabadello<o:p></o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Nov Matake<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There are three xri registrars now:<o:p></o:p></p>
<p class="MsoNormal"> fullxri - Markus<o:p></o:p></p>
<p class="MsoNormal"> 1id - In Australia<o:p></o:p></p>
<p class="MsoNormal"> Respect Network - Drummond Reed, etc.<o:p></o:p></p>
<p class="MsoNormal"> Respect Network has a number of resellers<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">i-names are now called cloud names<o:p></o:p></p>
<p class="MsoNormal">The main company developing services on top of cloud names is Respect Network<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">They plan to replace the @ symbol for business names with +<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike asked whether some of the providers are going to be supporting OpenID Connect<o:p></o:p></p>
<p class="MsoNormal">Markus finds is personally interesting in doing something to make xri compatible with OpenID Connect<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The original i-services are not supported by Respect Network<o:p></o:p></p>
<p class="MsoNormal"> OpenID 2.0<o:p></o:p></p>
<p class="MsoNormal"> Contact page<o:p></o:p></p>
<p class="MsoNormal">Respect Network has implemented an xri-based "Respect Connect" protocol<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John: Without xri.net running an OpenID Connect provider, migration could only happen for specific i-brokers<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It's not clear whether the right thing to do would be for xri.net to be the issuer or for the i-broker<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We believe that we can't ask Connect RPs to do anything special for i-names<o:p></o:p></p>
<p class="MsoNormal"> Ideally, you would type xri.net into discovery<o:p></o:p></p>
<p class="MsoNormal"> Or you could type fullxri.com<o:p></o:p></p>
<p class="MsoNormal"> The "sub" claim could just be the i-number<o:p></o:p></p>
<p class="MsoNormal"> The "iss" could be fullxri.com or another i-broker<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mike: For the Migration spec, we should say that the mechanisms for migrating i-names are still under discussion<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nat: We could allow the provider to return URLs like https://fullxri.com/<i-number> as the openid2_id claim<o:p></o:p></p>
<p class="MsoNormal">Mike: This wouldn't match the name in the database, which is the i-number<o:p></o:p></p>
<p class="MsoNormal">John: The openid2_id claim should be the claimed identifier<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John: The RP could do XRI resolution on the claimed identifier to discover the actual provider<o:p></o:p></p>
<p class="MsoNormal"> The OpenID Connect service could be added to the XRD<o:p></o:p></p>
<p class="MsoNormal"> This can be done by i-brokers without support from xri.net<o:p></o:p></p>
<p class="MsoNormal">John believes that people aren't likely to modify their XRI libraries to do any of this<o:p></o:p></p>
<p class="MsoNormal"> He believes that some kind of manual account linking to be the only practical approach<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Resolution: We should go to an implementer's draft saying that the openid2_id claim will be the verified identifier<o:p></o:p></p>
<p class="MsoNormal"> and that the mechanism for discovering the right provider is still TBD<o:p></o:p></p>
<p class="MsoNormal"> This mechanism could involve work by xri.net or by the i-brokers<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues:<o:p></o:p></p>
<p class="MsoNormal"> #949 Migration - (te) 2., and 6. verification rule (by Markus)<o:p></o:p></p>
<p class="MsoNormal"> Nat will fix with won't fix<o:p></o:p></p>
<p class="MsoNormal"> #950 Migration - (te) 4. xri portion needs change (by Markus)<o:p></o:p></p>
<p class="MsoNormal"> Accepted - see "Resolution" above<o:p></o:p></p>
<p class="MsoNormal"> #955 - Migration - (ge) xri.net support of the Migration spec<o:p></o:p></p>
<p class="MsoNormal"> Dup of 950<o:p></o:p></p>
<p class="MsoNormal"> #956 - Migration - (te) openid.identity support? (by Nov)<o:p></o:p></p>
<p class="MsoNormal"> We don't want to get into trying to define workarounds for OpenID 2.0 bugs<o:p></o:p></p>
<p class="MsoNormal"> Providers violating the OpenID 2.0 spec could similarly violate the migration spec to make things work<o:p></o:p></p>
<p class="MsoNormal"> Nat will add an implementer's note about extracting the fragment in this case<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>