[OpenID] Rule of thumb

[Simon Willison]

On 7/12/07, Peter Williams <pwilliams at rapattoni.com> wrote:
> I keep reading over and over again that only end-users (i.e. the
> students) select their OP; and can migrate it to various providers, at
> their whim. Or, register it with several providers -- in OpenID2.
>
> Isn't the concept of OpenID (user-centric id) contradictory with the
> notion that one has an "institutionally-provided OpenID"?

I don't think so at all, for a bunch of reasons:

1. My favourite thing about OpenID is that the protocol itself does
very little to dictate how you use it. This is a great thing! If you
want to set up an OpenID consumer that only accepts OpenIDs from
certain providers, or a provider that only works with "whitelisted"
consumers, the protocol will not stop you from doing so. The same is
true of any good protocol - the protocol is dumb, the applications get
to decide on the rules of how they will use it.

2. I fully expect people to have a number of different OpenIDs, even
though they will probably pick one as the OpenID they use for most
activities (especially SSO stuff). This is like e-mail addresses - I
use my personal address most of the time, but the company I work for
may well issue me with an institutional e-mail address which I will
use for work related communication.

3. Institutionally provided OpenIDs are fantastically useful. We're
already seeing them crop up in various interesting places - the Sun
provider that "proves" someone is a Sun employee, the Estonian OpenID
provider that asserts Estonian citizenship - all are interesting
applications of OpenID that enable new and exciting applications,
without preventing people from choosing to use some other provider if
they want.

Cheers,

Simon