<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Eric,<div><br></div><div>That sort of a centralized discovery mediator is the model we've been working with for some time, originally termed a WAYF and now a DS. Ours have been federation-centric, generally all the schools in a particular country, but there's now active discussion of scaling that up to have a centralized service.</div><div><br></div><div>We've been trying to get rid of the centralized WAYF/DS for a long time for two main reasons. The first is that the lists are getting preposterously long, with many hundreds of providers. The second is that the service is likely to have a better idea which IdP's it's willing to accept, and can constrain the selections available in advance.</div><div><br></div><div>You abstract away the first problem by assuming a different entry point -- from the IdP rather than the RP -- but we've had difficulties with that in practice, because users like to go to services first. The second can always be caught when the user fails authorization, which is possibly even preferable from a UX perspective. Even if we must face the first problem head-on, I don't think it's serious enough to make the CDS solution less appealing than the alternatives.</div><div><br></div><div>This is one of the many reasons federations have proven much more important and resilient than we'd ever imagined as the global Shibboleth deployment has grown. It's not the sort of decentralized model that many would like to see, but I concur that it's the most likely and reasonable solution at present.</div><div><br></div><div>Thanks for the input,</div><div>Nate.</div><div><br></div><div><div><div>On 11 Feb 2009, at 19:14, Eric Sachs wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><div>The Google team believes that for IDP discovery, there are options that can be achieved without browser extensions. In general Google always prefers solutions that can be supported by the existing installed base of browsers (especially mobile devices), as opposed to requiring client side software installations.</div><div><br></div><div>Here is a link to one such proposal that is not specific to IDP discovery, but is designed to make a user's web browsing preferences more portable.</div><div><br></div><a href="http://sites.google.com/site/oauthgoog/Home/pds">http://sites.google.com/site/oauthgoog/Home/pds</a><br></span></blockquote></div><br></div></body></html>