<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Xageroth,<br>
<br>
I'm mainly lurking here, but occasionally something catches my eye...<br>
<br>
Rabbit wrote:
<blockquote
cite="mid9c3223690612131949r3d3d34d1rf0de3004bb98ac63@mail.gmail.com"
type="cite">
<pre wrap="">[...]
And the only thing needed to make all that happen is a public key
entered into the equation. I appreciate all this feedback btw.
</pre>
</blockquote>
Which pre-supposes a prior relationship between RP and IdP (oh, ok
then, 'OP'), which is (as I understand things) counter to a design goal
of OpenID.<br>
<br>
And, to be honest, if you're going to muck with public keys, you might
as well go the whole hog and do SAML 2.0.<br>
<br>
Looking at <a
href="http://blogs.sun.com/superpat/entry/yadis%2Fxri_identifier_resolution_with_saml">my
YADIS-SAML demo</a> from last week, you could have the SAML Metadata be
somewhere on the interweb with the SSO endpoints (i.e..
<SingleSignOnService> - slide 13) set to localhost. POST profile
would work fine. I suspect <a
href="http://identitymeme.org/archives/2006/10/26/latest-revisions-of-saml-lsso-and-simplesign-specs/">Jeff'n'Scott's
SAML lightweight profile</a> would take care of most of the details -
you don't even need to do real XML Signature.<br>
<br>
Cheers,<br>
<br>
Pat
</body>
</html>