<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Unless with something like SAML's (nascent) Holder of Key profile<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.oasis-open.org/committees/download.php/29426/sstc-saml-holder-of-key-browser-sso-draft-07.pdf">http://www.oasis-open.org/committees/download.php/29426/sstc-saml-holder-of-key-browser-sso-draft-07.pdf</a><br>
<br>
Client authenticates directly with a cert to the SP, but that SP still
'relies' on the SAML assertion from the IDP<br>
<br>
paul<br>
<br>
Ben Laurie wrote:
<blockquote
cite="mid:1b587cab0810220255o77ef9f9bpf691a746a2e4b9c5@mail.gmail.com"
type="cite">
<pre wrap="">On Wed, Oct 22, 2008 at 4:18 AM, Dick Hardt <a class="moz-txt-link-rfc2396E" href="mailto:dick@sxip.com"><dick@sxip.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I would guess Ben is talking about authentication to the RP
</pre>
</blockquote>
<pre wrap=""><!---->
Actually, I meant any authentication - what does authentication to the
RP mean, anyway? If I am authenticating to it directly, then it isn't
an RP, right?
</pre>
<blockquote type="cite">
<pre wrap="">-- Dick
On 21-Oct-08, at 7:52 PM, Allen Tom <a class="moz-txt-link-rfc2396E" href="mailto:atom@yahoo-inc.com"><atom@yahoo-inc.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">OpenID does not specify how the user authenticates with their OP, so OPs
which support hooks for client side authentication seem to address your
concerns.
Allen
Ben Laurie wrote:
</pre>
<blockquote type="cite">
<pre wrap="">So if we're going to embark on a UX consistency campaign, should we
not do it around authentication that actually is safe - that is:
a) Built in to the browser, s.t. it can't be faked by webpages
b) Does not reveal the user's password in the process of authentication?
Continuing to try to prop up the house of cards that is authentication
on webpages seems counterproductive to me.
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1"><img
src="cid:part1.09050204.02090800@rogers.com" alt="ConnectID"
style="border: 0pt none ;"></a></div>
</body>
</html>