[OpenID] choosing endpoint after performing discovery on claimed_id from response
James Tindall
james at atomless.com
Tue Jul 22 13:48:11 UTC 2008
Suppose a relying party is operating under stateless mode. Suppose also
that the discovery phase for the given claimed_id returned more than one
endpoint. Then suppose that association attempts failed on at least one
of the endpoints but then succeeded on one of the other endpoints
further down the priority order. Then upon receiving the authentication
(id_res) response from the chosen OP the RP must perform discovery on
the claimed_id contained in the response in order to be able to verify
the response data against discovered data. But then if, as is probable,
the discovery phase again returns more than one endpoint, how is the RP
to choose which one to verify the response data against?
=james.tindall
More information about the general
mailing list