<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><span class="Apple-style-span" style="-webkit-text-stroke-width: -1; ">Deron</span></div></div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>My advice is don't delegate to OP's that are using directed identity.</div><div><br></div><div>You will get unpredictable results from RP's depending on how they preform validation of the returned claim.</div><div><br></div><div>In an upcoming openID 2.1 errata we are hoping to clarify this in the spec.</div><div><br></div><div>In sec 11.2 of OpenId 2.0</div><div><br></div><div>The verification rule is that if ether the openid.claimed_id or openid.identity changes then discovery must be preformed on the openid.claimed_id the openid.op_enpoint must match a URI value in the openID service.</div><div><br></div><div>What people get confused about is that if the openid.claimed_id is different from openid.identity then openid.identity must match the <LocalID> element.</div><div><br></div><div>So in your yahoo example your <LocalID> is <a href="http://yahoo.com/">http://yahoo.com/</a> and the openid.identity is <a href="https://me.yahoo.com/a/3Uz4wakJ.....etc.....'">https://me.yahoo.com/a/3Uz4wakJ.....etc.</a></div><div><br></div><div>If they matched then you would be good to go.</div><div><br></div><div>However if you use an RP who is not properly checking the openid.identity against the discovered information(a lot of them) anyone with a yahoo account can log into those RPs as <a href="http://deron.meranda.us/'">http://deron.meranda.us/</a></div><div><br></div><div>Verisign works because the <LocalID> matches what is returned in openid.identity.</div><div><br></div><div>Google is not supporting delegation as far as I can tell probably smart on there part.</div><div><br></div><div>The other thing that you will notice is that RP's are not all doing service selection according to the XRI 2.0 spec I have seen priority ignored or sometimes in reverse order in testing.</div><div><br></div><div>That is another thing that needs cleaning up in openID 2.1 and the upcoming XRD spec that replaces XRDS-Simple and Yadis.</div><div><br></div><div>I hope this helps.</div><div><br></div><div>Regards</div><div>John Bradley</div><div>=jbradley</div><div><br></div>Date: Thu, 6 Nov 2008 11:59:07 -0500<br>From: "Deron Meranda" <<a href="mailto:deron.meranda@gmail.com">deron.meranda@gmail.com</a>><br>Subject: [OpenID] Problems with delegation and directed identity OPs<br>To: "OpenID List" <<a href="mailto:general@openid.net">general@openid.net</a>><br>Message-ID:<br><span class="Apple-tab-span" style="white-space: pre; "> </span><<a href="mailto:5c06fa770811060859v52f661ael5bccd1fcee1b19b9@mail.gmail.com">5c06fa770811060859v52f661ael5bccd1fcee1b19b9@mail.gmail.com</a>><br>Content-Type: text/plain; charset=UTF-8<br><br>I am trying to use delegation with OPs that use directed identities and<br>I'm having problems getting it to work.<br><br>I want to use my own domain as my claimed identity<br><'<a href="http://deron.meranda.us/'">http://deron.meranda.us/'</a>>, but delegate to a public OP. So I set up an<br>XRDS document under my domain (using an X-XRDS-Location header).<br><br>I've tried this with three different public OPs that have different behaviors:<br><br> Verisign PIP - fixed identity<br> Yahoo! - directed ID , can choose among a set of IDs (default is randomish)<br> Google - directed ID, random per-RP identities<br><br>The XRDS document I'm serving from my domain contains these services:<br><br> <!-- **** GOOGLE **** --><br> <Service priority="1"><br> <Type><a href="http://specs.openid.net/auth/2.0/signon">http://specs.openid.net/auth/2.0/signon</a></Type><br> <URI><a href="https://www.google.com/accounts/o8/ud">https://www.google.com/accounts/o8/ud</a></URI><br> <LocalID><a href="https://www.google.com/accounts/o8/id">https://www.google.com/accounts/o8/id</a></LocalID><br> </Service><br><br> <!-- **** VERISIGN **** --><br> <Service priority="2"><br> <Type><a href="http://specs.openid.net/auth/2.0/signon">http://specs.openid.net/auth/2.0/signon</a></Type><br> <URI><a href="https://pip.verisignlabs.com/server">https://pip.verisignlabs.com/server</a></URI><br> <LocalID><a href="https://dmeranda.pip.verisignlabs.com/">https://dmeranda.pip.verisignlabs.com/</a></LocalID><br> </Service><br><br> <!-- **** YAHOO! **** --><br> <Service priority="3"><br> <Type><a href="http://specs.openid.net/auth/2.0/signon">http://specs.openid.net/auth/2.0/signon</a></Type><br> <URI><a href="https://open.login.yahooapis.com/openid/op/auth">https://open.login.yahooapis.com/openid/op/auth</a></URI><br> <LocalID><a href="http://yahoo.com/">http://yahoo.com/</a></LocalID><br> </Service><br><br>Now what I'm seeing varies depending on OP (I adjust the priority levels<br>to test each one)...<br><br>Verisign: Works. My RP gets a success with:<br> openid.claimed_id = '<a href="http://deron.meranda.us/'">http://deron.meranda.us/'</a><br> openid.identity = '<a href="https://dmeranda.pip.verisignlabs.com/'">https://dmeranda.pip.verisignlabs.com/'</a><br><br>Yahoo!: Almost works; Yahoo! let me pick which ID to use and returns<br>success with<br> openid.claimed_id = '<a href="http://deron.meranda.us/'">http://deron.meranda.us/'</a><br> openid.identity = '<a href="https://me.yahoo.com/a/3Uz4wakJ.....etc.....'">https://me.yahoo.com/a/3Uz4wakJ.....etc.....'</a><br>but then the RP fails while validating the response<br> "OpenID authentication failure: No matching endpoint found after<br>discovering <a href="http://deron.meranda.us/">http://deron.meranda.us/</a>"<br><br>Google: Works, but I don't keep my claimed id<br> openid.claimed_id =<br>'<a href="https://www.google.com/accounts/o8/id?id=AItOaw.....etc.....'">https://www.google.com/accounts/o8/id?id=AItOaw.....etc.....'</a><br> openid.identity =<br>'<a href="https://www.google.com/accounts/o8/id?id=AItOaw.....etc.....'">https://www.google.com/accounts/o8/id?id=AItOaw.....etc.....'</a><br><br>So how do I get OPs like Yahoo! and Google to delegate in the same way<br>that Verisign does?<br>-- <br>Deron Meranda<br></div></div><br></body></html>