[OpenID] OpenID Exchange

Martin Atkins mart at degeneration.co.uk
Mon Jan 15 08:08:34 UTC 2007

Dick Hardt wrote:
> Hi Martin
> What would you want OpenID Exchange to do that was not in OpenID  
> Attribute Exchange?

As I understand it, Attribute Exchange is a mechanism for exchanging 
sets of key-value pairs between parties, like "Simple Registration" 
taken to its logical conclusion.

OpenID Exchange[1] is a protocol for doing arbitrary HTTP requests 
between two sites where the caller acts on behalf of the user and the 
user gives that caller a one-time permission to perform the action.

So the two aren't really comparable except to say that Attribute 
Exchange could, in theory, use OpenID Exchange as a transport. I see 
that right now it's using OpenID Authentication as a transport, but I 
assume that this means that I cannot separate my "attribute provider" 
from my authentication provider.

OpenID Exchange can operate both standalone and as an OpenID 
Authentication Extension, although admittedly right now the 
Authentication Extension mode is underspecified and untested because 
I've been focusing on the "Post In My Weblog" protocol which makes no 
sense to bundle over an Authentication request.

I've intentionally avoided stepping on your toes by speccing anything 
for profile exchange over OpenID Exchange so far.


[1] I apologise for the "name collision" with them both having 
"Exchange" in the name; I've had this all lying around on my system here 
with the name "OpenID Exchange" since not long after I proposed its 
predecessor "user-accompanied RPC protocol", so I stuck with the name 
when I published it despite the fact that it now collides. Suggestions 
for alternative names that aren't horrifically verbose are welcomed.

More information about the general mailing list