<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Trey,<div><div><html><br></html><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">I apologize but the language of the spec (9.2) from a standpoint of speculation is hard to follow. I can't quite grasp how realms would facilitate the task at hand. Also I would assume auth.com is a trusted resource of some kind which is given permission to act as a proxy from which openId authentication occurs from.</font></p></blockquote><div><br></div><div>Using realms as in 9.2, you could ask openid.com to issue an assertion that was valid at both auth.com and end-domain.com by using appropriate wildcarding. Then, auth.com could just forward the assertion along unmodified and end-domain.com could accept it. The trouble is, issuing a *.com assertion is extremely bad practice, so you need either a lot of commonality in domain names, a real trust fabric, or, preferably, both.</div><div><br></div><div>Appreciate your patience through my long-winded explanations,</div><div>Nate.</div></div></div></body></html>