<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">I think a major problem with this approach (generic/collective ids) is that it provides no way for the RP to identity the particular entity that was using the ID. While it may not be important during the initial transaction, providing a method to attribute actions to a particular source may be important in some contexts.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>A typical solution to this problem is to send some sort of audit ID along with the claimed identity or other identity attributes. This attribute value would be newly generated for each transaction. However, the addition of a second attribute would require an attribute exchange protocol, which I think you are trying to avoid.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I believe Shibboleth and other similar systems would just send two claims, one that states you are staff, and one that has a valid audit id. I think this demonstrates that protocols based on collections of attributes handle these (slightly) more complicated requirements in a more direct way.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>You might argue that you don't need auditing - and you could be right. Perhaps OpenID with collective IDs is a simple and easy to deploy protocol that works for your environment.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Terry</DIV><DIV><BR><DIV><DIV>On May 21, 2007, at 21:58 , Peter (pt) Sefton wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite">Hi,<BR><BR>I'm new here. I have tried to find an answer to my question via the archive and the rest of the web, but no luck.<BR><BR>Is it reasonable to use OpenId with generic IDs? For example could my employer, a university have a generic ID like <A href="http://openid.myuni.edu.au/staff">http://openid.myuni.edu.au/staff</A> which would authenticate me as an anonymous staff member? We could then make a federation of universities who all trusted each other staff, maybe to provide WIFI. <BR><BR>For other cases which required the site I am visiting to know who I am, I could use <A href="http://openid.myuni.edu.au/staff/my.name">http://openid.myuni.edu.au/staff/my.name</A>. <BR><BR>Maybe I also have a role as a student: <A href="http://openid.myuni.edu.au/student/postgrad">http://openid.myuni.edu.au/student/postgrad</A>.<BR><BR>In this case I would not have to even remember all these URLs - the host site could have a kind of "Where are you from, what role do you have" form, so I would pick my home institution off a list, then say I'm a staff member and I want to remain anonymous, which is enough to generate the id: <A href="http://openid.myuni.edu.au/staff">http://openid.myuni.edu.au/staff</A><BR><BR>Is this being done already? Is it wrong in some way?<BR><BR>Peter<BR clear="all"><BR>-- <BR><BR>Peter Sefton<BR>Senior Research Fellow / RUBRIC Technical Manager <BR>RUBRIC Project, DeC<BR>University of Southern Queensland<BR>Toowoomba Queensland 4350 AUSTRALIA<BR><BR><BR>Work: <A href="mailto:sefton@usq.edu.au">sefton@usq.edu.au</A><BR>Private: <A href="mailto:pt@ptsefton.com">pt@ptsefton.com </A><BR><BR>p: +61 (0)7 4631 1640<BR>m: +61 (0)410 326 955<BR><BR>RUBRIC Website: <A href="http://www.rubric.edu.au">http://www.rubric.edu.au</A> <BR>USQ Website: <A href="http://www.usq.edu.au">http://www.usq.edu.au</A><BR> Personal Website: <A href="http://ptsefton.com">http://ptsefton.com</A><BR><BR>RUBRIC is supported by the Systemic Infrastructure Initiative as part of<BR>the Commonwealth Government's Backing Australia's Ability - An <BR>Innovative Action Plan for the Future<BR>(<A href="http://backingaus.innovation.gov.au">http://backingaus.innovation.gov.au</A>)<BR><BR>The University of Southern Queensland is a registered provider of<BR>education with the Australian Government. <BR><BR>(CRICOS Codes: QLD 00244B | NSW 02225M | VIC 02387D | WA 02521C)<DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">_______________________________________________</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">general mailing list</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="mailto:general@openid.net">general@openid.net</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</A></DIV> </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>