<div class="gmail_quote">On Wed, Jun 24, 2009 at 4:24 PM, Peter Williams <span dir="ltr"><<a href="mailto:pwilliams@rapattoni.com" target="_blank">pwilliams@rapattoni.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
we typically say that a good RP would use the validated localid as its primary key, especially in the delegation flows.</blockquote></div><br>If I understand you correctly, all I have to do is set up a claimed identifier that points to my own OP endpoint, but uses <i>your</i> localid value. Then I can spoof your identity at a 'good RP'. Is that right?<br>
<br>Claimed Identifiers are supposed to be "primary keys" -- not local ids! Nowhere in the OpenID protocol does the user prove he controls an OP local identifier. They only prove they control the Claimed Identifier. Therefore, RPs must only key off of the claimed ID. <br>