<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
SitG Admin wrote:
<blockquote cite="mid:f06110401c55b83073885@%5B192.168.0.2%5D"
type="cite">
<blockquote type="cite">We toyed with this idea in Liberty for SAML
but never did anything with it - partly because it would already work
out of the box with SSO protocols as they are if the RP coordinates the
multiple authentications.
<br>
</blockquote>
<br>
Exactly - the exciting answers here will not be "HOW can we do it?" but
"WHY should we do it?".
<br>
<br>
<blockquote type="cite">We did think of optimizations whereby you
could eliminate some redirects by having (in OpendID terminology) the
first RP indicate to the first OP the second OP in the openid.return_to
- I'm not sure this would be legal in OpenID?
<br>
</blockquote>
<br>
What do you mean by the first RP?
<br>
</blockquote>
yes, 'first' is redundant, there is only the one<br>
<blockquote cite="mid:f06110401c55b83073885@%5B192.168.0.2%5D"
type="cite"><br>
My understanding of the process here (my own poor statements
notwithstanding) is that the user would have multiple *URI's*, each
with their own OP, and use all of these with a single (suspicious) RP.
<br>
</blockquote>
yes, and by default the sequence would be<br>
<br>
RP-OP1-RP-OP2-RP<br>
<br>
a permutation would have the first OP, after authenticating the user,
redirect the browser to the second OP rather than back to the RP. Only
after authenticating would the browser be sent to the RP<br>
<br>
RP-OP1-OP2-RP<br>
<br>
But this muddies up the request/response model and creates privacy
implications<br>
<br>
if its the RP doing the coordinating, its not clear to me what the
relevance of XRDS to enable or optimize this. If an RP cares enough to
require 2 authns, it will likely have its own idea as to what OPs are
appropriate, notwithstanding any 'primary' or 'secondary' designations <br>
<br>
<blockquote cite="mid:f06110401c55b83073885@%5B192.168.0.2%5D"
type="cite"><br>
-Shade
<br>
<br>
<br>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1"><img
src="cid:part1.00040807.02060309@rogers.com" alt="ConnectID"
style="border: 0pt none ;"></a></div>
</body>
</html>