<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">In 6 Generating Signatures the example it has "alg":"RSA-SHA256" however the only supported alg is RSA-SHA1.<div><br></div><div><br><div><div>7.2</div><div><span class="Apple-style-span" style="font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; "><p style="margin-left: 2em; margin-right: 2em; ">The end user's input MUST be normalized into an Identifier, as follows:</p><div style="margin-left: 2em; margin-right: 2em; "><br class="webkit-block-placeholder"></div><ol class="text" style="margin-left: 2em; margin-right: 2em; "><li style="margin-left: 3em; ">If the user's input starts with the "xri://" prefix, it MUST be stripped off.</li><li style="margin-left: 3em; ">If the first character of the resulting string is an XRI Global Context Symbol ("=", "@", "+", "$", "!") or "(", as defined in Section 2.2.1 of<a class="info" href="http://openid.net/specs/openid-authentication-2_0.html#XRI_Syntax_2.0" style="font-weight: bold; position: relative; z-index: 24; text-decoration: none; color: rgb(153, 0, 0); background-color: transparent; ">[XRI_Syntax_2.0]</a>, then the input SHOULD be treated as an XRI. Prepend <a href="https://xri.net/">https://xri.net/</a> to the XRI to make it a URL.</li><li style="margin-left: 3em; ">Otherwise, the input SHOULD be treated as an http URL; if it does not include a "http" or "https" scheme, the Identifier MUST be prefixed with the string "http://". If the URL contains a fragment part, it MUST be stripped off together with the fragment delimiter character "#". See<a class="info" href="http://openid.net/specs/openid-authentication-2_0.html#http_s_identifiers" style="font-weight: bold; position: relative; z-index: 24; text-decoration: none; color: rgb(153, 0, 0); background-color: transparent; ">Section 11.5.2</a> for more information.</li><li style="margin-left: 3em; ">URL Identifiers MUST then be further normalized by both following redirects when retrieving their content and finally applying the rules in Section 6 of <a class="info" href="http://openid.net/specs/openid-authentication-2_0.html#RFC3986" style="font-weight: bold; position: relative; z-index: 24; text-decoration: none; color: rgb(153, 0, 0); background-color: transparent; ">[RFC3986]</a> to the final destination URL. This final URL MUST be noted by the Relying Party as the Claimed Identifier and be used when <a class="info" href="http://openid.net/specs/openid-authentication-2_0.html#requesting_authentication" style="font-weight: bold; position: relative; z-index: 24; text-decoration: none; color: rgb(153, 0, 0); background-color: transparent; ">requesting authentication</a>.</li></ol></span><div><br></div><div>7.4 Besides the public key we should allow the RP to list supported encryption alg</div><div><br></div><div>7.6</div><div><br></div><div>The Artifact Authentication Request MUST contain one <span class="Apple-style-span" style="font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; ">openid.artifact OR openid.ppfurl. Both can not be present in the request.</span></div><div><font class="Apple-style-span" face="verdana, charcoal, helvetica, arial, sans-serif"><span class="Apple-style-span" style="font-size: small;"><br></span></font></div><div><font class="Apple-style-span" face="verdana, charcoal, helvetica, arial, sans-serif"><span class="Apple-style-span" style="font-size: small;">The openid.rpfurl MUST be https:// ? I like the hash but it makes the request larger and people won't check it, I think https: is safer.</span></font></div><div><font class="Apple-style-span" face="verdana, charcoal, helvetica, arial, sans-serif"><span class="Apple-style-span" style="font-size: small;"><br></span></font></div><div><font class="Apple-style-span" face="verdana, charcoal, helvetica, arial, sans-serif"><span class="Apple-style-span" style="font-size: small;"><br></span></font></div><div><br></div><div>7.9</div><div>This needs more work I will try and get to it shortly</div><div><br></div><div><br></div></div></div></div></body></html>