One last plea: fix problem with "delegate" terminology

Martin Atkins mart at degeneration.co.uk
Tue Oct 3 07:43:48 UTC 2006


Drummond Reed wrote:
> 
> However, in the two months since I last had that conversation, I've had to
> explain the concept of "OpenID delegate" to a bunch more people, and I'm
> telling you, STICKING WITH THIS TERMINOLOGY IS GOING TO BITE OPENID IN THE
> BUTT!!
> 
> The problem is: the more OpenID grows, the more folks who are familiar with
> mainstream identifier systems like DNS are going to be exposed to it, and
> the more they are going to go bananas trying to figure out what OpenID means
> by this term "delegate" when essentially the OpenID meaning is the exact
> opposite of what everyone else in the naming world means by it.
> 

I propose simply that openid:Delegate becomes openid:Identifier. This is 
actually a variation on my early proposal for then OpenID bindings for 
Yadis, where I intentionally avoided using the "delegate" terminology.

    <Service priority="50">
     <Type>http://openid.net/signon/1.1</Type>
     <URI>http://www.whatever.com/openid</URI>
     <openid:Identifier>http://mart.whatever.com/</openid:Identifier>
    </Service>

Perhaps I should have made this more explicit at the time, but my 
thinking here was to separate "the identifier I present to the RP" from 
"the identifier I present to my IdP".

This does change the mental model a bit, but it also makes it more 
consistent and thus, to my mind, easier to wrap your head around. I 
suspect it'd also be easier to explain in the spec. The implementation 
remains the same, of course.

I find this model fits a lot better than the delegation model. In 
particular, it's not possible to cascade "delegations" — that is, you 
can't delegate to another identifier which itself delegates to a third. 
This confused me in the early days. If you think instead of the URI here 
being a "login" for the named IdP, suddenly everything seems to make 
more sense.

Backward-compatibility isn't of great concern here since OpenID 2 is 
presumably going to have its own Yadis service type anyway, so those 
supporting both will need to list both 1.1 and 2.0 Service elements, 
which don't necessarily have to be the same.





More information about the specs mailing list