<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p dir="ltr">I can give Paul some realty specific context (since his firm gets to do the job I did till recently).</p>
<p dir="ltr">Imagine joomla has a local rp login page flow, that expects to cooperate with an idp at the end of a chain of websso handoffs.. Today it might use websso (ceding page control), but tomorrow openid connect ( keeping page control).</p>
<p dir="ltr">In the websso era, to avoid losing page control to the idp, architecture arranged for the idp to render as a (javascript) control (in some division of the rps page tree). Any websso protocol ' s (rendering) effect was thus limited to the viewport
of that div. This allowed the rp "to control" the overall message (particularly when switching multiple idps).</p>
<p dir="ltr">Obviously some idp business models hated that wanting to impose (think fbi) central policy. Nothing stops a now easily manipulated rp from abandoning the protective architecture (and becoming beholden to the idp regime, to whom the economic value
then flows). Silly rp, in my view, but I also no longer care...</p>
<p dir="ltr">Now with openid one can use the protocol to effect those architecture decisions (rather than kludge with Javascript controls etc).<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</p>
<p dir="ltr">Sent from <a href="https://aka.ms/blhgte">Outlook Mobile</a><br>
</p>
<br>
<br>
<br>
<div class="gmail_quote">On Wed, Mar 2, 2016 at 3:16 PM -0800, "John Bradley" <span dir="ltr">
<<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>></span> wrote:<br>
<br>
</div>
<div class="" style="word-wrap:break-word">It has to do with the size of the display the IdP has to work within.
<div class="">The RP makes the popup. This theoretically kept the user on the RP’s page. </div>
<div class=""><br class="">
</div>
<div class="">At the time RP resisted doing full page redirects and possibly having the user loose context.</div>
<div class=""><br class="">
</div>
<div class="">John B.</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 2, 2016, at 8:03 PM, Phil Hunt <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div class="" style="word-wrap:break-word">Wasn’t it a way to pass a value to the user interface to give a justification for the request for personal information and/or authentication?
<div class=""><br class="">
<div class="">
<div class="" style="letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; word-wrap:break-word">
<div class="" style="letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; word-wrap:break-word">
<div class=""><span class="x_Apple-style-span" style="border-collapse:separate; line-height:normal; border-spacing:0px">
<div class="" style="word-wrap:break-word">
<div class="">
<div class="">
<div class="">Phil</div>
<div class=""><br class="">
</div>
<div class="">@independentid</div>
<div class=""><a href="http://www.independentid.com/" class="">www.independentid.com</a></div>
</div>
</div>
</div>
</span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans:2; widows:2">phil.hunt@oracle.com</a></div>
<div class=""><br class="">
</div>
</div>
<br class="x_Apple-interchange-newline">
</div>
<br class="x_Apple-interchange-newline">
<br class="x_Apple-interchange-newline">
</div>
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 2, 2016, at 2:37 PM, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" class="">ve7jtb@ve7jtb.com</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div class="" style="word-wrap:break-word">I recall it was a early requirement from Facebook and JainRain.
<div class=""><br class="">
</div>
<div class="">There was a popup extension for openID 2.</div>
<div class=""><a href="http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html" class="">http://svn.openid.net/repos/specifications/user_interface/1.0/trunk/openid-user-interface-extension-1_0.html</a></div>
<div class=""><br class="">
</div>
<div class="">I suspect that anyone using the popup extension from openid 2 kept using the popup dimensions.</div>
<div class=""><br class="">
</div>
<div class="">On looking at the parameter in the Connect Core specification it is underspecified on it’s own.</div>
<div class=""><br class="">
</div>
<div class="">JainRain and some others were using it. I don’t know if there has been any real demand for it in Connect. </div>
<div class="">That is probably why no one has pointed it out prior to this.</div>
<div class=""><br class="">
</div>
<div class="">It should be fleshed out in a profile.</div>
<div class=""><br class="">
</div>
<div class="">John B.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 2, 2016, at 7:17 PM, Cal Heldenbrand <<a href="mailto:cal@fbsdata.com" class="">cal@fbsdata.com</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">Hmm, yeah you're right, now that I think about it. There is no way to window.open() a popup from the Provider without nuking the browser's current window. If your main authentication page is a responsive view, then the display parameter
probably doesn't matter. But maybe it's for those that might want to have a stateful knowledge before rendering the DOM that it's going to be a small view?<br class="">
</div>
<div class="x_gmail_extra"><br clear="all" class="">
<div class="">
<div class="x_gmail_signature"><br class="">
---------------------------------------------------------------<br class="">
Cal Heldenbrand<br class="">
Web Operations at FBS<br class="">
Creators of <a href="http://flexmls.com/" target="_blank" class="">flexmls</a>® and
<a href="http://sparkplatform.com/" target="_blank" class="">Spark Platform</a><br class="">
<a href="mailto:cal@fbsdata.com" target="_blank" class="">cal@fbsdata.com</a></div>
</div>
<br class="">
<div class="x_gmail_quote">On Wed, Mar 2, 2016 at 3:09 PM, Paul Hethmon <span dir="ltr" class="">
<<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank" class="">paul.hethmon@clareitysecurity.com</a>></span> wrote:<br class="">
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div class="" style="word-wrap:break-word">So I can see that, but that would require the RP to create that pop-up window, not the OP.
<div class=""><br class="">
</div>
<div class="">At the end of the day, if they reach my OP, they’ll get my login screen in a browser window (with prompt=popup), which still qualifies as meeting specification since its a SHOULD. But I hate not understanding the meaning or use case.</div>
<span class="x_HOEnZb"><font color="#888888" class="">
<div class=""><br class="">
</div>
<div class="">Paul</div>
</font></span>
<div class="">
<div class="x_h5">
<div class=""><br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 2, 2016, at 4:04 PM, Cal Heldenbrand <<a href="mailto:cal@fbsdata.com" target="_blank" class="">cal@fbsdata.com</a>> wrote:</div>
<br class="">
<div class="">
<div dir="ltr" class="">I believe that's for an AJAX request in a popup window. (or maybe a modal dialog?)
<br class="">
</div>
<div class="x_gmail_extra"><br clear="all" class="">
<div class="">
<div class=""><br class="">
---------------------------------------------------------------<br class="">
Cal Heldenbrand<br class="">
Web Operations at FBS<br class="">
Creators of <a href="http://flexmls.com/" target="_blank" class="">flexmls</a>® and
<a href="http://sparkplatform.com/" target="_blank" class="">Spark Platform</a><br class="">
<a href="mailto:cal@fbsdata.com" target="_blank" class="">cal@fbsdata.com</a></div>
</div>
<br class="">
<div class="x_gmail_quote">On Wed, Mar 2, 2016 at 2:48 PM, Paul Hethmon <span dir="ltr" class="">
<<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank" class="">paul.hethmon@clareitysecurity.com</a>></span> wrote:<br class="">
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
In section 3.1.2.1 of Core, it details the 4 options for the “display” parameter. While the 4 options are clear enough, I don’t get the intent of having “page” vs “popup”. If the client has been redirected to the OP for authentication, there’s a full browser
window sitting there, so why ask the OP to popup something over that? I haven’t found any archived discussion or blogs on the subject and feel I must totally be missing the point here.<br class="">
<br class="">
Discussion here or a pointer to something is greatly appreciated.<br class="">
<br class="">
thanks,<br class="">
<br class="">
Paul<br class="">
<br class="">
-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
<br class="">
_______________________________________________<br class="">
general mailing list<br class="">
<a href="mailto:general@lists.openid.net" target="_blank" class="">general@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-general" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-general</a><br class="">
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
<div class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
_______________________________________________<br class="">
general mailing list<br class="">
<a href="mailto:general@lists.openid.net" class="">general@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-general" class="">http://lists.openid.net/mailman/listinfo/openid-general</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
_______________________________________________<br class="">
general mailing list<br class="">
<a href="mailto:general@lists.openid.net" class="">general@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-general" class="">http://lists.openid.net/mailman/listinfo/openid-general</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>