<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV>Just to weigh in here...</DIV><DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"> <FONT face="Helvetica, Arial, sans-serif"></FONT><BR> Paul Madsen wrote: <BLOCKQUOTE cite="mid456F3223.8090600@rogers.com" type="cite">Hi George, for your use case below, why would not the RP just ask for the user to be up-authenticated at the desired higher level when necessary? <BR> </BLOCKQUOTE> <FONT face="Helvetica, Arial, sans-serif">So in the draft... how does the RP ask for the user to be "up-authenticated"? The authentication request parameters do not in any way indicate a previous authentication, and the extension parameters also don't include any way to indicate a previous authentication. That is what I really meant by the authentications being "standalone". The RP may relate the two authentications in some way because it requested both. Maybe that's good enough.<BR></FONT></BLOCKQUOTE>Basically, you would require the second method with a max_age of "0" - which, assuming the RP honors the request, would tell the RP to re-authenticate the user with the requested method. </DIV><DIV><BR><BLOCKQUOTE type="cite"><FONT face="Helvetica, Arial, sans-serif"> </FONT> <BLOCKQUOTE cite="mid456F3223.8090600@rogers.com" type="cite"><BR> Are you asking whether the RP should be allowed to ask the user to re-present their URI in order for this to happen? And thereby effectively treating each event as disconnected/standalone? <BR> </BLOCKQUOTE> <FONT face="Helvetica, Arial, sans-serif">Ideally, the user would not be able to change their URI when being re-challenged based on max_auth_age but I guess the RP should make sure to code for that edge case.<BR></FONT></BLOCKQUOTE><DIV>Agreed - it's the RPs choice.</DIV><BR><BLOCKQUOTE type="cite"><FONT face="Helvetica, Arial, sans-serif"> </FONT> <BLOCKQUOTE cite="mid456F3223.8090600@rogers.com" type="cite"><BR> Wrt combinations, I know from experience that the alternative to allowing for RPs to specify combinations is a combinatorial explosion in the number of mechanism identifiers. <BR> </BLOCKQUOTE> <FONT face="Helvetica, Arial, sans-serif">I agree that the combinations can explode... but they are also useful. For example to hack my account you need both my "password" and my "hardotp". That's two "secrets" that need to be determined for my account to be compromised. (Not that this doesn't stop phishers).<BR> </FONT><FONT face="Helvetica, Arial, sans-serif"><BR></FONT></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV></DIV><DIV>Actually, this could be pretty simple to implement:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Replace openid.aqe.preferred_auth_mode with the following:<FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"></SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN>openid.aqe.auth_factor1</SPAN></FONT></DIV><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Optional: The method of authentication the RP would like the OP to perform, or in the case of a multi-factor authentication, the first method that the RP would like the OP to perform. The mode should match one of the advertised values in the XRDS. If this is not specified, then any authentication method is acceptable.</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Value: Comma-delimited list of "none", "password", "pin", "fingerbio", "handbio", "hardotp", "irisbio", "otherbio", "smartcard", "softotp", "voicebio"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Note: The OP should attempt to authenticate the user with the most secure mode requested. For example, if the OP has determined that their voicebio method is stronger than their password method and the RP requests either "voicebio or password", the OP should strive to authenticate the user by "voicebio" when possible. If the two modes are considered equally strong, then it is the choice of the OP regarding which one or ones to authenticate against. OPs should note that authenticating a user by a non-preferred method may result in an RP denying access.</SPAN></FONT></P><DIV><SPAN class="Apple-tab-span" style="white-space:pre; font-family: Verdana; font-size: 13px; "> </SPAN><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor2</SPAN></FONT></DIV><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Optional: In the case of a multi-factor authentication, the second method that the RP would like the OP to perform. The mode should match one of the advertised values in the XRDS. If this is not specified, then any authentication method is acceptable. If this is not specified, it is assumed that the RP is requesting only a single factor for authentication. The OP will not use the same method for this factor as was used in any previous factors. For example, if the first factor is a password, the second factor cannot also be a password.</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Value: Comma-delimited list of "none", "password", "pin", "fingerbio", "handbio", "hardotp", "irisbio", "otherbio", "smartcard", "softotp", "voicebio"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">Note: The OP should attempt to authenticate the user with the most secure mode requested. For example, if the OP has determined that their voicebio method is stronger than their password method and the RP requests either "voicebio or password", the OP should strive to authenticate the user by "voicebio" when possible. If the two modes are considered equally strong, then it is the choice of the OP regarding which one or ones to authenticate against. OPs should note that authenticating a user by a non-preferred method may result in an RP denying access.</SPAN></FONT></P><DIV><SPAN class="Apple-tab-span" style="white-space:pre; font-family: Verdana; font-size: 13px; "> </SPAN><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor3</SPAN></FONT></DIV><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">... you can figure how it would continue. There are very few use cases that would use more than two factors.</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">So, in this case, if you want the user to authenticate with two factors, first with a password and second with a securID or voice biometric print...</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor1 = "password"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor2 = "hardotp", "voicebio"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">conversely, if you want two factors, which could be any combination of password, hardotp or voicebio in any combination:</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor1 = "hardotp", "voicebio", "password"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor2 = "hardotp", "voicebio", "password"</SPAN></FONT></P><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>the response from the OP, assuming that it followed the request from the RP would look like</DIV><DIV><BR class="khtml-block-placeholder"></DIV><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor1 = "password"</SPAN></FONT></P><P style="margin: 0.0px 0.0px 13.0px 26.0px"><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;">openid.aqe.auth_factor2 = "hardotp"</SPAN></FONT></P><DIV><FONT class="Apple-style-span" face="Verdana" size="3"><SPAN class="Apple-style-span" style="font-size: 13px;"><BR class="khtml-block-placeholder"></SPAN></FONT></DIV><DIV>I would think that this is clear enough that we could make the small change to the spec to allow for this type of methodology. </DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Thoughts?</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>- Avery</DIV><DIV><BR><BLOCKQUOTE type="cite"><FONT face="Helvetica, Arial, sans-serif"> Thanks,<BR> George<BR> </FONT><BR> <BLOCKQUOTE cite="mid456F3223.8090600@rogers.com" type="cite"><BR> Paul <BR> <BR> George Fletcher wrote: <BR> <BLOCKQUOTE type="cite">+1 simple and straight forward <BR> <BR> Just curious about uses cases where the required authentication level changes over time. For instance, a use case where to view my stock portfolio just requires "password", but doing a trade requires "voicebio". Is the expectation that authentication events can be treated as "standalone"? or that it's the RP's responsibility to manage the combinations based on the identifier? <BR> <BR> One final question... Is it valuable to provide a way to request two or more authentication methods be employed in the authentication event? For example, administrators of a site must use both "password" and "hardotp". Everyone else just needs "password". <BR> <BR> Thanks, <BR> George <BR> <BR> <BR> _______________________________________________ <BR> general mailing list <BR> <A class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</A> <BR> <A class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</A> <BR> <BR> <BR> </BLOCKQUOTE> <BR> </BLOCKQUOTE><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">_______________________________________________</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">general mailing list</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="mailto:general@openid.net">general@openid.net</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</A></DIV> </BLOCKQUOTE></DIV><BR></BODY></HTML>