Using XRI Proxy Resolvers in OpenID discovery

[Eran Hammer-Lahav]

It has been mentioned on this list that XRI might be optional in OpenID 2.0.
If you read the spec with that mindset you can find ways to prove it. Your
answer is that all three discoveries are a MUST and if that's the case,
there is little point in this thread.

OpenID 1.1 allowed for a very dumb RP. I was able to implement the entire
spec from scratch in C++ in under a day. OpenID 2.0 took 10 days and it's
still not complete (missing authority validation). My suggestion was to
consider allowing RP's to avoid dealing with XRI and XRDS by requiring HTML
discovery support on the End User side, and making sure that the redirection
of http://xri.net/=eran will end in an HTML document with HTML-based
discovery. It will allow existing OpenID 1.1 implementations to work XRIs
with a tiny change.

I am well aware I joined this group when it's at the end of the draft cycle,
and I can appreciate the significant amount of work and thought that went
into the specification.

EHL


-----Original Message-----
From: Johnny Bufu [mailto:johnny at sxip.com] 
Sent: Monday, July 30, 2007 3:45 PM
To: Eran Hammer-Lahav
Subject: Re: Using XRI Proxy Resolvers in OpenID discovery


On 30-Jul-07, at 12:30 PM, Eran Hammer-Lahav wrote:

> I guess what's confusing is:
>
> Section 7.3.3 begins with: "HTML-Based discovery MUST be supported by
> Relying Parties".

Not sure I understand what is confusing - section is about HTML  
discovery only (not about Yadis etc.).

> What does MUST mean with regard to non HTML discovery?

Nothing - the 7.3.3 does not apply to non HTML discovery.

> If you take that line out, is the meaning of the spec unchanged?

I suppose yes, since an equivalent MUST / SHALL exists in 7.3. The  
reinforcement was felt necessary in 7.3.3 as some believed HTML  
discovery was optional in OpenID 2.0.

(RPs that don't support HTML discovery will not be able to use  
identifiers from OPs that support only HTML discovery.)


Johnny