<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Noah Slater:
<blockquote cite="mid:20080313112924.GC24515@bytesexual.org" type="cite">
<pre wrap="">On Thu, Mar 13, 2008 at 04:34:22AM +0200, Eddy Nigg (StartCom Ltd.) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">By using the param "claimed_id" as the authorized ID, it can confuse
some folks. Something like "auth_id" (from authorized ID) or
"confirmed_id" or "real_id" or "response_id" could have made it
clearer....just not something with the word "claim" in it...I guess this
is what happens.
</pre>
</blockquote>
<pre wrap=""><!---->
I am pretty sure I used non of this terminology in my original report.
I will outline my use case using as little OpenID jargon as possible:
1. Find interesting blog post on <a class="moz-txt-link-rfc2396E" href="http://example.org/2008/01/plankton/"><http://example.org/2008/01/plankton/></a>
2. Write comment to the blog post
3. Asked to provide OpenID to submit comment
4. Input <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/"><http://bytesexual.org/></a>
5. Press submit
6. The website dereferences my OpenID
7. My OpenID URI does a 303 redirect to <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/about/"><http://bytesexual.org/about/></a>
8. <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/about/"><http://bytesexual.org/about/></a> contains delegation information
9. The website delegates and takes me to <a class="moz-txt-link-rfc2396E" href="http://claimid.net/"><http://claimid.net/></a>
10. Authenticate at <a class="moz-txt-link-rfc2396E" href="http://claimid.net/"><http://claimid.net/></a> which takes me back to the website
11. My comment has been posted on the website
12. My name on the comment is a link to <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/about/"><http://bytesexual.org/about/></a>
13. ... time passes ...
14. Come back to the site, read a new post and want to comment
15. The comment form autocompletes my OpenID as <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/about/"><http://bytesexual.org/about/></a>
Like I have said before, I don't know much about OpenID so I couldn't tell you
which part of the OpenID stack is causing this problem or why but I do know
enough about HTTP and URIs to see that there is a problem here.
All this talk of XRIs, URNs and URLs is beside the point. What I consider to be
my OpenID <a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/"><http://bytesexual.org/></a> is a plain old URI and it is dereferencable
via HTTP yet the semantics of HTTP are being broken as
<a class="moz-txt-link-rfc2396E" href="http://bytesexual.org/about/"><http://bytesexual.org/about/></a> is explicitly not to be considered a replacement
URI for the original one requested. It doesn't matter what the OpenID
specification says, these facts can't be changed and the semantics can't be
reinterpreted to fit some arbitary security model.
In this specific use case do you still think that OpenID is behaving correctly?</pre>
</blockquote>
OK, Noah, I think I got it this time around....<br>
<br>
If I read and understand correctly, than this is a failure/feature of
the implementation of your OpenID provider. It might be done by them
also on purpose. Maybe the RP or OP is following specs 1.1 and not 2.0.
In the case of the later, the OP should have provided
<a class="moz-txt-link-freetext" href="http://bytesexual.org/">http://bytesexual.org/</a>
as your OpenID (at least this is what you believe is your OpenID
anyway).<br>
<br>
However the redirects performed by your OP aren't really relevant in
this respect. The claimed_id returned by your OP is simply
<a class="moz-txt-link-freetext" href="http://bytesexual.org/about/">http://bytesexual.org/about/</a>
and not <a class="moz-txt-link-freetext" href="http://bytesexual.org/">http://bytesexual.org/</a>. Guess they are the ones you should
address then...<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>