<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Trey & Eddy,</div><div><br></div><div>We've experimented with this style of authentication chaining(read: proxying) for quite some time, and there are legitimate use cases for it when the intercepting party is adding attributes or doing protocol translation. OP -> RP -> OP -> RP, essentially.</div><div><br></div><div>The implementation's really simple and generally doesn't even require any new code, but there are two real caveats:</div><div><br></div><div>1) The user interface issues associated with choosing two different identifiers can be challenging for users. How do they know which OP to use when? Do they have to go through two identity selection steps?</div>2) Preserving trusted attributes/identity information from the original OP/IdP through to the end consumer is really difficult when you're dealing with bearer credentials. There are no real controls on the repackaging of information by the middle box that are easily enforced, so it has to be a trusted service. If the middle box is only asserting information and identifiers for which it's authoritative, this is moot, but it also makes the use case a lot less interesting.<div><br></div><div>Take care,</div><div>Nate.</div><div><br><div><html>On 23 Apr 2008, at 14:27, Eddy Nigg (StartCom Ltd.) wrote:</html><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; ">I guess not, but I think this is entirely possible: auth.com is an OpenID provider to authenticate to other sites, using itself an OpenID consumer for authentication :-) Seems to be a quite easy implementation IMO.<br></span></blockquote></div><br></div></body></html>