<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On 02008:01:21, at 7:57CST, Peter Williams wrote:</div><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Intending to speak non-threateningly, I know (as a security designer on the dumber end of the know-how spectrum) that I want next to investigate SAML2 and its use of NAPTRs. Its in this area where there appears a conflict of infrastructure vision between openid and SAML2 - one that concerns me.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Openid Auth (over https) is fine as a lightweight websso protocol. But, the whole XRD and XRI emphasis conflicts with general IETF direction in DNS, NAPTRs, walled-garden ENUM etc. I know for my part, I don't yet know how to reconcile these two infrastructure visions on resolving names to services, particular the websso assurance depend on secure name resolution. I do know I'm personally arming a new SAML2 party each week (in US realty), with increasingly sophisticated use of the fancier SAML2 features (which bodes well for openid2, which the same feature set as SAML in the 80% of features that most matter).<span class="Apple-converted-space"> </span></div></blockquote><div><br class="webkit-block-placeholder"></div><div>What are you refering to about conflicts with the IETF direction? I haven't monitored IETF work in years, so please excuse my ignorance. Are you referring to the way XRI extends existing URI infrastructure? Does non-XRI XRD resolution (nee yadis) overcome these conflicts in your eyes?</div><br><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Whilst we@rapattoni have made a commitment to ensure we can join realty's websso infrastructure to the web2.0 world via openid2, beyond that limited goal I'm not sure how to characterize what we will do with openid. I think it all comes down to SPECIFICALLY how the UCI management vision takes off, or not, in such as business applications that are building on all the various successful social networking practices proven over the last few years.</div></blockquote><br></div><div>I wonder, are you implementing openid alongside SAML2? It seems that most of the SSO uses we've had at my work are best solved with OAuth, although if the site you're SSOing with acts as an OP, I guess AX would be sufficient.</div><div><br class="webkit-block-placeholder"></div><div> <span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><div>http:// Joseph Holsten .com</div><div><br class="webkit-block-placeholder"></div></span><br class="Apple-interchange-newline"> </div><br></body></html>