<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite" class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "><br></div></blockquote><div><br></div>Not requiring a simultaneous authentication was intended to be possible. See the language from the OpenID 2.0 Authentication spec below that hints that things are possible without authenticating the user.</div><div><br></div><div>In practice, no one has wanted to move attributes without authenticating ... so the exact mechanics for doing it may not be represented in the spec.</div><div><br></div><div>Suggestions?</div><div><br></div><div>-- Dick<br><br><blockquote type="cite" class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "># openid.claimed_id</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> Value: (optional) The Claimed Identifier.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> "openid.claimed_id" and "openid.identity" SHALL be either both present or both absent. If neither value is present, the assertion is not about an identifier, and will contain other information in its payload, using extensions (Extensions).</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> It is RECOMMENDED that OPs accept XRI identifiers with or without the "xri://" prefix, as specified in the Normalization (Normalization) section.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "># openid.identity</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> Value: (optional) The OP-Local Identifier.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> If a different OP-Local Identifier is not specified, the claimed identifier MUST be used as the value for openid.identity.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "> Note: If this is set to the special value "<a href="http://specs.openid.net/auth/2.0/identifier_select">http://specs.openid.net/auth/2.0/identifier_select</a>" then the OP SHOULD choose an Identifier that belongs to the end user. This parameter MAY be omitted if the request is not about an identifier (for instance if an extension is in use that makes the request meaningful without it; see openid.claimed_id above).</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><br></div></blockquote></div><div><br></div><div><br></div><br><div><div>On 26-May-08, at 11:56 AM, Andrew Arnott wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">I think a simultaneous authentication is necessary because without it, the openid.claimed_id and openid.identity parameters will be missing, and thus no way for the OP to determine what Identifier is being queried for attributes. <br> <br>From the AX spec:<br><h3 style="margin-left: 40px;">3.1. Subject Identifier</h3><p style="margin-left: 40px;"> An identifier for a set of attributes. It MUST be a URI. <i>The subject identifier corresponds to the end-user identifier in the authentication portion of the messages</i>. In other words, the <i>subject of the identity attributes in the attribute exchange part of the message is the same as the end-user in the authentication part. The subject identifier is not included in the attribute exchange</i>. </p>It seems that the only way for an RP to send an OP an OpenID message with extensions for this purpose without actually requesting authentication is to leave off the claimed_id and identity parameters, which kills AX's use of them. At least that's how I unerstand the OpenID 2.0 spec. Perhaps I misunderstand it. If I do misunderstand it, how is an extension supposed to send a request without a simultaneous authentication request?<br><br>Thanks.<br> <br><div class="gmail_quote">On Mon, May 26, 2008 at 11:43 AM, Dick Hardt <<a href="mailto:dick@sxip.com">dick@sxip.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div style="">The Subject Identifier is to let the OP and RP know which user is being referred to. An authentication request SHOULD not be needed. <div><br></div><div>In other words, you should be able to do what you want to do now ... why do you think you can't?</div> <div><br></div><div>-- Dick<br><div><br><div><div><div></div><div class="Wj3C7c"><div>On 25-May-08, at 7:43 AM, Andrew Arnott wrote:</div><br></div></div><blockquote type="cite"><div><div></div><div class="Wj3C7c">Attribute Exchange seems to rely on being part of an authentication message as opposed to being able to work when in OpenID's no-authentication extension mode. I get this from section <a href="http://openid.net/specs/openid-attribute-exchange-1_0.html#identifier-definition" target="_blank">3.1</a> of the AX spec getting the subject identifier from the authentication part of the message.<br> <br>My suggestion would be that if we can, in a subsequent version of AX, allow AX to stand alone without OpenID having to send an authentication request at the same time, then given an OpenID URL by itself, people can query against it. Now, most information would probably need to be kept private, but perhaps some information, like contact information, can be made available provided the requestor respond to a CAPTCHA or something like that. That would be up to the individual OPs and their users of course as to which information to be willing to disseminate, but the power of the feature is there.<br> <br>What do you think?<br clear="all"><br>-- <br></div></div>Andrew Arnott _______________________________________________<br>general mailing list<br><a href="mailto:general@openid.net" target="_blank">general@openid.net</a><br> <a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br></blockquote></div><br></div></div></div></blockquote></div><br><br clear="all"><br>-- <br>Andrew Arnott</blockquote></div><br></body></html>