<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Steven,<div><br></div><div><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span class="Apple-style-span" style="color: rgb(0, 0, 221); font-size: 12px; -webkit-text-stroke-width: -1; ">They are likely to go with Shibboleth (currently using Athens) at the core because of the higher level of trust and verification as compared to OpenID.</span></p></span></blockquote><div><br></div><div>The UK Federation for Access Management is up to 618 members (<a href="http://www.ukfederation.org.uk">http://www.ukfederation.org.uk</a>/), and they're working very hard to ensure a consistently good level of practices and trust throughout. It's truly multilateral and a high level of assurance, and they've done excellent work.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><span class="Apple-style-span" style="color: rgb(0, 0, 221); font-size: 12px; -webkit-text-stroke-width: -1; ">I argued that to the public user OpenID is much easier to attain and run with – especially with Google. Microsoft, Yahoo etc now supporting it.</span></span></p></span></blockquote><div><br></div><div>This is no doubt true, but I think that Yahoo, Microsoft, and Google offer a very different level of trust and verification with their email accounts. They've got a business to run.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><p class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span class="Apple-style-span" style="color: rgb(0, 0, 221); font-size: 12px; -webkit-text-stroke-width: -1; ">There was also the argument that you can protect resources directly using Shibboleth. Now maybe someone working on this can correct me, but my guess is that if you can’t already, you will soon be able to map an OpenID to a token (say a SID in windows) and you’ll protect resources using the common operating system rather than a brand new way of protecting resources. True?</span></p></span></blockquote></div><br></div><div>Shibboleth's SP design is more at work here than anything protocol-related here. The SP is built to protect resources and paths directly, like a filter, with very little to no modification of or integration into the application. As far as integration with the operating system goes, if CardSpace rises from the grave -- four days too late for that metaphor to be good -- then we'll all be in good shape regardless. Microsoft's new Geneva identity suite will probably offer a lot of integration, with all the good and "aaaargh" that comes with that.</div><div><br></div><div><a href="http://www.theregister.co.uk/2008/10/30/microsoft_generva_hailstorm/">http://www.theregister.co.uk/2008/10/30/microsoft_generva_hailstorm/</a></div><div><br></div><div>I'd like to remind people to focus a little less on protocols we use and a little more on trust structures. OpenID as a protocol couldn't support these trust structures today, partially by design; that could change in the future as the set of deployers changes. Today, Shibboleth is, in my incredibly biased opinion, a fine choice for your application that requires trusted identity from known sources and privacy for your users.</div><div><br></div><div>Thanks for the interesting anecdote,</div><div>Nate.</div></body></html>