Re: [community] from W3C….Fwd: Proposal: "User" header field

[Torsten Lodderstedt]

Hi Kingsley,

so your are essentially saying, the user agent (or a similar application) sets a URL, which the server uses in turn to obtain some values. These values are used to meet access control decisions. Did I get this right?

How does the server ensure the caller is the user represented by this URL? So for example, how would you prevent an attacker from sending your user id URL to the server (and in turn impersonating you on this server)?

Regards,
Torsten.

Am 19.07.2013 um 15:42 schrieb Kingsley Idehen <kidehen at openlinksw.com>:

> On 7/19/13 4:14 AM, Torsten Lodderstedt wrote:
>> Hi,
>> 
>> could you please shed some light on the use case for the User field? What entity sets the value, what entitity uses it for what purpose?
> 
> It holds a URI that resolves to a document bearing content that describes the URIs referent. For example, this document could be comprised of a machine-readable entity->attribute->value  or subject->predicate->object based relations. 
> 
> An end-user application (including browser extensions or plugins) will set the value. A server will make use of these values e.g., looking up the URIs to locate the description of the entity denoted (named) by the URI. It can then use this description as the basis for ACLs and sophisticated data access policies which are all driven by logic. 
> 
> 
> Kingsley 
>> 
>> Regards,
>> Torsten.
>> 
>> 
>> 
>> Kingsley Idehen <kidehen at openlinksw.com> schrieb:
>>> 
>>> On 7/18/13 1:38 PM, Torsten Lodderstedt wrote:
>>>> I fully agree with George und would like to add: why don't you just use the authorization header to send identity data/credentials/tokens to the server in order to allow for access control?
>>> 
>>> This is already possible. The requirement here stems from the fact that "From:" is bound specifically to mailto: scheme URIs (Uniform Resource Identifiers). We are looking to "User:" to be the superClass of "From:" which is basically URI scheme agnostic. That's it. 
>>> 
>>> [SNIP]
>>> -- 
>>> 
>>> Regards,
>>> 
>>> Kingsley Idehen       
>>> Founder & CEO 
>>> OpenLink Software     
>>> Company Web: http://www.openlinksw.com
>>> Personal Weblog: http://www.openlinksw.com/blog/~kidehen
>>> Twitter/Identi.ca handle: @kidehen
>>> Google+ Profile: https://plus.google.com/112399767740508618350/about
>>> LinkedIn Profile: http://www.linkedin.com/in/kidehen
>>> 
>>> 
>>> 
>>> 
> 
> 
> -- 
> 
> Regards,
> 
> Kingsley Idehen	      
> Founder & CEO 
> OpenLink Software     
> Company Web: http://www.openlinksw.com
> Personal Weblog: http://www.openlinksw.com/blog/~kidehen
> Twitter/Identi.ca handle: @kidehen
> Google+ Profile: https://plus.google.com/112399767740508618350/about
> LinkedIn Profile: http://www.linkedin.com/in/kidehen
> 
> 
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs/attachments/20130719/58cf0658/attachment.html>