<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
If someone with knowhow can help, I want to play with the next level of google integration. I want to play with the reality of host-metas, in an multi-vendor theatre. I want to determine if the meta world is still at the research stage, or its more mature. SHould I go away and wait for a couple of more years, is my dilemma?<BR> <BR>The context is this:<BR> <BR>The Microsoft-run gateway to Google's version of the openid protocol talks to the traditional google endpoint; it works fine. I want to now configure references to the unique tenants of the google cloud. I hope to then configure the microsoft gateway's claim mapping, so it uses the TENANT identity to drives its attribute sourcing/origination/mapping rules.<BR> <BR>If I recall back 1-2 years, Google had some kind of XRD file hosted on each tenant's domain, whose values would orchestrate the main Google endpoint actingFor the tenant. As a result, the tenant was an IDP in its own right distinct from Google (the brand), where the endpoint services of Google would actually deliver the services on the wire - albeit customized now with per IDP keying and naming.<BR> <BR>I may have my openid terms for cloud-tenant-virtualization world wrong. The "generic," multi-tenant google service may be known as the IDP, and the (virtualized) tenants as OPs - in much the same way as the generic cloud endpoint is sometimes known as the SP, whereas the tenants with (virutalized) per-tenant assertion consuming endpoints are known as RPs. This all corrupts traditional terms, but does at least characterize the cloud-ness - ready for mass virtualization.<BR> <BR>Im hoping that the Microsoft gateway can now do the orchestration dance, using the XRD files of the IDP/OP, fixing up the "virtual endpoint" to "real endpoint" mappings on the fly, acting as the party processing inbound assertions. At the same time, such a gateway will need to be _validating_ the tenant/cloud metadata that drives this (security critical) process, somehow; and presumably be doing it PER OP (virtual tenant of the Google IDP). <BR> <BR>I'm interested to see how this is done for real, and how its all been packaged. Is it really on PKI and required validation of signed XRD streams? Or, will it be derived from the https trust model, requiring that the tenant's XRD(s) (with the security critial mapping info) be delivered over a particular https channel, perhaps? What is the formal name for such a bridging proxy (e.g. the Microsoft ACS service), and what is the name for its "per-OP" (virtual Google endpoint) configuration that controls the attribute origination/mapping process<BR> <BR> </div></body>
</html>