[OpenID] Too many providers... and here's one reason

[Peter Williams]

Couldn't this be handled by the XRI support, in the openid 2 world?

Doesn't the XRI resolver allow the organizational claim to be tested?

XRI essentially has a yellow-pages resolver built in. For any yellow page index, you can resolve a name via that particular naming path. The XRI resolver thus tests that one is listed in a particular "organizational" index, or which there can be n. In trusted XRI, furthermore, the SAML assertions would provide additional proof that the particular resolver listener is authorized to speak for those organizations. In the HXRI trusted resolver variety, the usual trick of the proxy resolver having n*1000 SSL server, one per organization, would be sufficient to know that the listener speaks for the organization (over https)

-----Original Message-----
From: general-bounces at openid.net [mailto:general-bounces at openid.net] On Behalf Of Dick Hardt
Sent: Monday, September 15, 2008 5:12 PM
To: Andrew Arnott
Cc: general at openid.net
Subject: Re: [OpenID] Too many providers... and here's one reason


On 15-Sep-08, at 4:45 PM, Andrew Arnott wrote:

> I just spoke with an organization that wants to become a Provider so
> that other RP web sites can specifically tell if the logging in user
> is a member of this organization by whether their OpenID Identifier
> was asserted by that org's OP.
>
> Ideally, I'd like this org to choose to be an RP instead of an OP
> because there are already too many OPs out there and not enough RPs,
> IMO.
>
> How can an RP accept an OpenID Identifier from arbitrary OPs, but at
> each login determine whether the Identifier represents a user who
> belongs to a particular Organization?  Basically the Organization
> needs to send an assertion about the Identifier's membership, but
> only be willing to do so if that identifier is confirmed as having
> logged in successfully to that RP.  This would be easy to do if that
> Org was an OP, but I'm trying to reduce the # of reasons to be an OP.

I have envisioned this as a chain of assertions / claims.

The user has a claim that their identifier is a member of the org.
This claim could be cached or obtained each time it is needed.

The user then presents that claim (binding identifier to org
membership) and also proves that they control the identifier presented
to the RP.

InfoCards has this flow speced out ... will be interesting to see if
there is interest in this from the OpenID community, particularly
since this is where the identity  protocols really  start to
differentiate themselves from existing username/password and form fill.

-- Dick

_______________________________________________
general mailing list
general at openid.net
http://openid.net/mailman/listinfo/general