<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">Ok. Really that's its really a standardized oauth, with websso between as and idp. Furthermore, one can signal choice of attribute contracts, as an sp. Furthermore, the idps shown in the home realm
screen is configured per sp.<br>
<br>
In my case, we don't mint (or format) the jwt. We borrow a Microsoft azure service for that (mostly so they can ensure conformance and interoperability). They choose to put the user grant in a namid field (of an access token).<br>
<br>
Standardizing claim names in an id token feels like a rats nest, since this had failed a dozen times already. We did ensure a transforming wsfedp agent can remint tokens (mapping claim names and value syntaxes), knowing from our own industry that every sp affiliation
wants things done differently (mostly to compete with other sp affiliations, add value, or instrument protectionism).<br>
<br>
All that remains is to understand how the id cert relates to the access token. For thus the relationship feels almost identical to the x509 authz cert (pac), and the x509 id cert (with 3 extensions bearing user naming/descriptive attribute).<br>
<br>
Is there anything more to openid connect, at heart?<br>
<br>
As I say, I have to decide whether to bother advocating for it, or not, now.<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">From:
</span><span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif"><a href="mailto:sakimura@gmail.com">Nat Sakimura</a></span><br>
<span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">Sent:
</span><span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">9/20/2013 6:58 AM</span><br>
<span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">To:
</span><span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif"><a href="mailto:home_pw@msn.com">Peter Williams</a></span><br>
<span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">Cc:
</span><span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif"><a href="mailto:openid-general@lists.openid.net">openid-general@lists.openid.net</a></span><br>
<span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">Subject:
</span><span style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">Re: [OpenID] openid connect. what is it?</span><br>
<br>
</div>
<div dir="auto">
<div>OpenID Connect at its core is the standardized JWT (JWS) </div>
<div>and the way to ask for specific characteristics.</div>
<div>You seem to be doing more or less the same </div>
<div>thing as OIDC. Main difference seems to be the </div>
<div>fact the OIDC leaves the access token alone </div>
<div>as implementations may want it intact. </div>
<div>Obviously, the claim names also are different.</div>
<div><br>
=nat via iPhone</div>
<div><br>
Sep 20, 2013 15:50、Peter Williams <<a href="mailto:home_pw@msn.com">home_pw@msn.com</a>> のメッセージ:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div>
<div style="font-size:11pt; font-family:Calibri,sans-serif">Oauth client website server induces users browser to visit authz endpoint. This is a websso dp which concludes websso with an idp (which does RSA baysian network tracking/identification of user devices,
from passive tracking signals left by web standards (insecurity properties).) upon release of jwt over websso (wsfedp in our case), delegation record is registered for websso session and associated one time code goes off to website registered to vendor running
oauth client.<br>
<br>
Client (server thread, here) exchanges one time code for access token - which is another jwt blob, signed with rsa, with namid field. Its value is the nameid from websso assertion. ( In another profile, the nameid is the entire websso assertion.)<br>
<br>
Now that I understand, being a minor variation of 30 year old x500 security services, using alternative signed blob formats and alternative chaining protocols between server agents.<br>
<br>
If the above is oauth2, its fine. It looks pretty interoperable, based on a signed blob agreement, a naming record, and a couple of conversation protocols.<br>
<br>
I hope I answered the first paragraph question.<br>
<br>
If openid connect now just has the authz endpoint show an idp picker screen, this I can do (obviously). The idp must support openid, saml2, or wsfedp for websso. ( If its wsfedp, there can be a chain of issuers, any one or several of which can show the home
realm selector experience).<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">From:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:sakimura@gmail.com">Nat Sakimura</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Sent:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">9/19/2013 11:06 PM</span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">To:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:home_pw@msn.com">Peter Williams</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Cc:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:openid-general@lists.openid.net">openid-general@lists.openid.net</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Subject:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">Re: [OpenID] openid connect. what is it?</span><br>
<br>
</div>
<div>
<div dir="ltr">Let me then ask this: With OAuth, how did you communicate the information about the authentication event and of the identity between the server and client in an inter-operable manner?
<div><br>
</div>
<div>In short, OpenID Connect is something that provides it.
<div><br>
</div>
<div>For JW*, <a href="http://self-issued.info/">http://self-issued.info/</a> would be a good resource. </div>
<div><br>
</div>
<div>OpenID Connect has no UI at all. Selector like thing is Account Chooser, which is another specification being worked on at OpenID Foundation. </div>
<div>For a basic description of what it is, perhaps you can look at <a href="https://www.accountchooser.com/learnmore.html">https://www.accountchooser.com/learnmore.html</a> . </div>
<div><br>
</div>
<div>Best, </div>
<div><br>
</div>
<div>Nat</div>
</div>
</div>
<div class="x_x_gmail_extra"><br>
<br>
<div class="x_x_gmail_quote">2013/9/20 Peter Williams <span dir="ltr"><<a href="mailto:home_pw@msn.com" target="_blank">home_pw@msn.com</a>></span><br>
<blockquote class="x_x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div>
<div style="font-size:11pt; font-family:Calibri,sans-serif">Good try. But it didn't deliver the story.<br>
<br>
It said that id cert standardizes some Facebook thing (that I know nothing about, since Facebook is irrelevant to us).<br>
<br>
It seemed to hint at the old (pre NSA surveillance state) position, of making idps (or as partners) govern RP privacy policies, limiting who gets which sensitive claims. In a total surveillance climate, this American privacy- initiatives looks silly (and deceptive
even).<br>
<br>
We were left with some academic schema statements based on inverted models of identity (you are the attributes attached to different relations). The point was lost. I felt like I was learning about an isam file structure (without knowing why).<br>
<br>
I .was confused about the point of showcasing yet more jw* standards. All I guessed was that things will be day reimplement ws)secureconversation, perhaps, swapping byte format. This seemed to be a wap moment (having designed for a phone world * pre* broadband
rate data plans, and handheld cpu/ram bigger than my university had for the entire engineering faculty.<br>
<br>
I was left with only one hint, from phone UI pictures. It was that oauth facilitates their being a native logon app, that supports other apps on the phone in that idps ecosystem. (and maybe other idp app sellers, if 2 idp chhose to coordinate - like all, yahoo
and live in the era of I'm<br>
<br>
Just as I waited 3y for oauth to mature (and finally makes its case), wondering whether I should just ignore openid connect - and look again in 2-3 years?<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">From:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:sakimura@gmail.com" target="_blank">Nat Sakimura</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Sent:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">9/19/2013 4:16 PM</span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">To:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:home_pw@msn.com" target="_blank">Peter Williams</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Cc:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:openid-general@lists.openid.net" target="_blank">openid-general@lists.openid.net</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Subject:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">Re: [OpenID] openid connect. what is it?</span><br>
<br>
</div>
<div>
<div class="x_x_h5">
<div dir="auto">
<div>This page may help you understand what OpenID Connect is based on your understanding of OAuth. </div>
<div><br>
</div>
<div><span style="font-family:'.HelveticaNeueUI'; font-size:15px; line-height:19px; white-space:nowrap"><a href="http://nat.sakimura.org/2013/07/05/identity-authentication-oauth-openid-connect/" target="_blank">http://nat.sakimura.org/2013/07/05/identity-authentication-oauth-openid-connect/</a></span></div>
<div><font face=".HelveticaNeueUI"><span style="font-size:15px; line-height:19px; white-space:nowrap"><br>
</span></font></div>
<div><span>ID Token has been used by google for sometime. </span></div>
<div><span>It's predecessor, signed request of Facebook has been used very widely as well. </span></div>
<div><span><br>
</span></div>
<div><span>=nat via iPhone</span></div>
<div><br>
Sep 20, 2013 7:33、Peter Williams <<a href="mailto:home_pw@msn.com" target="_blank">home_pw@msn.com</a>> のメッセージ:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">Having deployed an isp-class oauth service, I feel I know what OAUTH is (finally). Rather than have an embedded authentication website, it does websso to an IDP. In other words, the AS is itself an websso SP.<br>
<br>
Now, I understand that a few tweaks of messages in OAUTH allows that AS-webssoSP bridge to invoke a selector screen - by which users choose IDPs from a list. And, I understand that the OAUTH tweaks might indicate which of several IDP lists to use, where a OAUTH
IDP-class service can tune-its self up to offer multiple private label experiences, selected by some or other label sent in an OAUTH message.<br>
<br>
Is that ALL opened "connect" is? (a way of hosting lots of identity selector pages, together with the config of the IDP metadata, etc; and a way of choosing which page of selections to present)?<br>
<br>
Ive also seen hints that "companion" JWTs might accompany the access token. Known as id-tokens, they don't actually seem to exist in the wild (not having escaped the paper lab, yet). As far as I can tell, they are just JWTs with more than the nameid claim,
thereby avoiding a per-IDP API call (just to collect a yahoo API's vs facebook APIs member record claimset).<br>
<br>
Is this opened connect?<br>
<br>
I've also seen hints that the companion JWT is supposed to be a mobile account-linking record; similar to the old account linking service elements of OASIS. is this opened connect? If there is "evidence" that several access tokens all relate to a common persistent
name (ahem XRD id, for structured names) represented by the id-token, is this openid connect?<br>
<br>
<br>
<br>
<br>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>general mailing list</span><br>
<span><a href="mailto:general@lists.openid.net" target="_blank">general@lists.openid.net</a></span><br>
<span><a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_blank">http://lists.openid.net/mailman/listinfo/openid-general</a></span><br>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>general mailing list</span><br>
<span><a href="mailto:general@lists.openid.net">general@lists.openid.net</a></span><br>
<span><a href="http://lists.openid.net/mailman/listinfo/openid-general">http://lists.openid.net/mailman/listinfo/openid-general</a></span><br>
</div>
</blockquote>
</div>
</body>
</html>