<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
p.Default, li.Default, div.Default
{mso-style-name:Default;
margin:0in;
margin-bottom:.0001pt;
text-autospace:none;
font-size:12.0pt;
font-family:"Arial","sans-serif";
color:black;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal style='margin-bottom:6.0pt;text-align:justify;text-autospace:
none'><span style='font-size:11.0pt;color:black'>Given the likes of Google (services)
and Microsoft (software and services) are doing both SAML2 and OpenID2, its
worth looking at the convergence space again. Appropriately, we can look to
Drummond’s paper, which says<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:6.0pt;text-align:justify;text-autospace:
none'><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
6.0pt;margin-left:.5in;text-align:justify;text-autospace:none'><span
style='font-size:11.0pt;font-family:"Cambria","serif";color:black'>”The
OASIS SAML specifications include authentication flows very similar to OpenID
except for the initial discovery steps [26]. So it is not surprising that they
can be adapted to use the same XRDS discovery mechanism as OpenID 2.0. The only
difference is the use of a SAML authentication service endpoint. This flow was
demonstrated by Pat Patterson of Sun at Internet Identity Workshop in December
2006 [27]. <o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-size:11.0pt;
font-family:"Cambria","serif";color:black'>This flow can be further enhanced to
provide automated discovery of the SAML metadata [28] necessary to interact
with the SAML service provider. By including an XRI as the value of the </span><span
style='font-size:11.0pt;font-family:"Cambria","serif";color:black'><xrd:ProviderID>
</span><span style='font-size:11.0pt;font-family:"Cambria","serif";color:black'>element
in the SAML authentication service endpoint, an RP can use XRI trusted
resolution to resolve this identifier and obtain another XRDS with service
endpoint(s) advertising the location of the service provider’s SAML
metadata”<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;color:black'>Now I have to
admit, I’m struggling with the basics of this proposition. It seems to
say, that an OpenID2 RP would wish to converse with an SAML2 SP – and various
bit of jiggery-pokery with multi-level resolution can facilitate such things.
But why would an RP want to talk to another RP (known as an SP in SAML-speak)?...unless
its participating in an SP affiliation (like AX update)?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;color:black'>Is there are
strong reason why this somewhat esoteric example of SAML/OpenID2 convergence
(by sharing XRDS) was chosen as the example of iterative discovery?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
general-bounces@openid.net [mailto:general-bounces@openid.net] <b>On Behalf Of </b>Peter
Williams<br>
<b>Sent:</b> Monday, November 10, 2008 6:21 PM<br>
<b>Cc:</b> OpenID List<br>
<b>Subject:</b> [LIKELY_SPAM][OpenID] OpenID Identity Discovery with XRI and
XRDS<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-family:"Cambria","serif";color:black'>I
just reread Drummond et al’s infamous (really, well-written) paper on the
design motivations of openid auth 2.0, particularly as those motivations refer
to discovery. It’s well worth rereading, occasionally.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Cambria","serif";color:black'><o:p> </o:p></span></p>
<p class=Default><o:p> </o:p></p>
<p class=Default align=center style='margin-bottom:3.0pt;text-align:center'> <b><span
style='font-size:18.0pt'>OpenID Identity Discovery with XRI and XRDS </span></b><span
style='font-size:18.0pt'><o:p></o:p></span></p>
<p class=Default><span style='color:windowtext'><o:p> </o:p></span></p>
<p class=Default><span style='color:windowtext'> <o:p></o:p></span></p>
<p class=Default align=center style='text-align:center'><span style='font-size:
11.5pt;color:windowtext'>Drummond Reed <o:p></o:p></span></p>
<p class=Default align=center style='margin-bottom:4.0pt;text-align:center'><span
style='font-size:10.0pt;color:windowtext'>Cordance Corp. 3020 Issaquah-Pinelake
RDF #74 Sammamish WA 98075 +1.206.618.8530 <o:p></o:p></span></p>
<p class=Default align=center style='margin-bottom:3.0pt;text-align:center'><span
style='font-size:11.5pt;color:windowtext'>drummond.reed@cordance.net <o:p></o:p></span></p>
<p class=Default align=center style='text-align:center'><span style='font-size:
11.5pt;color:windowtext'>Les Chasen <o:p></o:p></span></p>
<p class=Default align=center style='margin-bottom:4.0pt;text-align:center'><span
style='font-size:10.0pt;color:windowtext'>Neustar, Inc. 46000 Center Oak Plaza
Sterling VA 20166 +1.571.434.5474 <o:p></o:p></span></p>
<p class=Default align=center style='margin-bottom:3.0pt;text-align:center'><span
style='font-size:11.5pt;color:windowtext'>les.chasen@neustar.biz <o:p></o:p></span></p>
<p class=Default align=center style='text-align:center'><span style='font-size:
11.5pt;color:windowtext'>William Tan <o:p></o:p></span></p>
<p class=Default align=center style='margin-bottom:4.0pt;text-align:center'><span
style='font-size:10.0pt;color:windowtext'>Neustar, Inc. 46000 Center Oak Plaza
Sterling VA 20166 +1.571.434.5400 <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.5pt'><a
href="mailto:william.tan@neustar.biz">william.tan@neustar.biz</a><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Cambria","serif";color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
</div>
</body>
</html>