[OpenID] Problems with delegation and directed identity OPs

Sat Nov 8 03:15:00 UTC 2008

My understanding is that an OpenID Identity page with just the below tag
MUST be the claimed identifier in the RP's eyes, and the rules of delegation
would also include that since no openid2.local_id tag is included that the
claimed_id and local_id be the same.  So there's no way that Google's OP
should authorize that OpenID for anyone except the one whose local_id
matches Google's user database.

On Fri, Nov 7, 2008 at 6:12 PM, Allen Tom <atom at yahoo-inc.com> wrote:

> How does someone delegate their OpenID URL to Google?
>
> Putting following into the <head> section of the OpenID page:
>
> <link rel="openid2.provider" href="https://www.google.com/accounts/o8/ud"
> />
>
> seems to allow *any* user with a Google account to sign in with the
> delegated OpenID.
>
> Allen
>
>
> Breno de Medeiros wrote:
> >
> > Bottom line: The fact that the op_local technique is not available for
> > usage with the Google OP does not mean that it cannot support
> > delegation.
> >
> >
>
> _______________________________________________
> general mailing list
> general at openid.net
> http://openid.net/mailman/listinfo/general
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-general/attachments/20081107/a2c19388/attachment-0002.htm>