<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
The workaround, for Yahoo! as an OP, is to<br>
1) choose a specific Yahoo identifier (when you log in, Yahoo! will<br>
let you see your current set of ID choices, and create new ones)<br>
2) embed that identifer in the HTML page at the claimed URL as<br>
described in<br>
<a href="http://openid.net/specs/openid-authentication-2_0.html#anchor50" target="_blank">http://openid.net/specs/openid-authentication-2_0.html#anchor50</a><br>
<br>
If Yahoo sends an RP a positive assertion for a "local ID" (ugly<br>
<a href="http://me.yahoo.com" target="_blank">me.yahoo.com</a> directed identity URL) that matches the local_id that<br>
was embedded in the HTML page at the nice URL you entered, then<br>
you've proved your identity of the nice URL without having to run<br>
an OP on that domain name. Get tired of Yahoo? Get a new OP and put<br>
the local ID they use for you on your web site. This is a very good,<br>
pro-user feature of OpenID -- as long as you use control the web page<br>
whose URL you claim, you can switch providers at will.</blockquote><div><br>Yeah, I grok delegation (do we not call it that anymore?), that's how I do mine.<br> <br>I was actually meant to ask if there were a workaround for Ben's situation. But, given Yahoo! are actively trying to prevent what he wants to do, that seems unlikely ;)<br>
<br>To clarify for anybody who is wondering why all the fuss. Ben's model was the simplest possible. Such neat UX that I was surprised nobody else has done it (and now I see why).<br><br>1. He asks for the email address you use for Flickr. <br>
2. Then queries on it and gets your Flickr photo URL. <br>3. Then asks you to 'authenticate' you Flickr account from within the account he just created for you in his app<br>4. Intending that Yahoo would verify ownership by saying 'yes, Peter does control that Flickr account.'<br>
<br>The problem being that Yahoo doesn't do Step 4. And even worse, it actively stymies it, by sending back any successful response. So all it proves is that the user has *a* Yahoo account - it may not be associated with *any* Flickr accounts, let alone the one requested.<br>
<br>After all this, I'm assuming the answer is no way, no how, but... Is there a workaround for Step 4?<br><br>Lachlan Hardy<br></div></div>