<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Peter Williams:
<blockquote cite="mid:ED5DB9F0-65B3-4CC7-A76C-F841FF93792C@mimectl"
type="cite">
<div id="idOWAReplyText61839" dir="ltr">
<div dir="ltr"> </div>
<div dir="ltr">My identityalliance desktop middleware (PKCS#11 etc)
should allow me now to do SSL client auth, using the self-signed cert I
made and stored on my GlobalPlatform card from IBM Zurich - presenting
it to your site to now enroll the card/publickey with a second
(isomorphic?) openid. </div>
</div>
</blockquote>
No, not really...the client cert must be issued by us. OpenID is for us
a by-product, or better said, a by-service.<br>
<blockquote cite="mid:ED5DB9F0-65B3-4CC7-A76C-F841FF93792C@mimectl"
type="cite">
<div id="idOWAReplyText61839" dir="ltr">
<div dir="ltr">Hopefully, you have no pre-conceptions of just who you
trust to issue client auth statements, via SSL?</div>
</div>
</blockquote>
Yes, we do :-)<br>
<br>
The initial client cert issued by StartSSL functions as a
boot-strapping certificate for account authentication. We retain full
control over this process in every respect. That's NOT because of
OpenID but for other reasons.<br>
<blockquote cite="mid:ED5DB9F0-65B3-4CC7-A76C-F841FF93792C@mimectl"
type="cite">
<div id="idOWAReplyText61839" dir="ltr">
<div dir="ltr"> </div>
<div dir="ltr">Lets see where it leads. Lets see if I can a create a
second openid for the one card, and (b) bind your OP's (second) openid
to my one plaxo account.</div>
</div>
</blockquote>
Lets hear how it goes...<br>
<blockquote cite="mid:ED5DB9F0-65B3-4CC7-A76C-F841FF93792C@mimectl"
type="cite">
<div id="idOWAReplyText61839" dir="ltr">
<div dir="ltr"> </div>
<div dir="ltr">Peter</div>
<div dir="ltr">
<hr tabindex="-1"></div>
<div dir="ltr"><font face="Tahoma" size="2"><b>From:</b> Eddy Nigg
(StartCom Ltd.)<br>
<b>Sent:</b> Sat 3/8/2008 4:30 PM<br>
<b>To:</b> Peter Williams<br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a><br>
<b>Subject:</b> Re: [OpenID] [Muscle] updated experience, 2 years
later.<br>
</font><br>
</div>
</div>
<div>If we are at it, I invite you to read <a moz-do-not-send="true"
title="Permanent Link to PKI, SSO and Smart Cards explained"
href="https://blog.startcom.org/?p=81" target="_blank" rel="bookmark">PKI,
SSO and Smart Cards explained</a> and <a moz-do-not-send="true"
title="Permanent Link to Smart Cards made easy on Linux and Firefox"
href="https://blog.startcom.org/?p=82" target="_blank" rel="bookmark">Smart
Cards made easy on Linux and Firefox</a><br>
<br>
Peter Williams:
<blockquote type="cite">
<div id="idOWAReplyText36006" dir="ltr">
<div dir="ltr"> </div>
</div>
<div dir="ltr">Read the thread from the bottom, if interested in
one user's experience linking open source smartcards to openid, linking
up to plaxo.</div>
<div dir="ltr"><br>
</div>
</blockquote>
</div>
</blockquote>
</body>
</html>