Notes and decisions from July 7, spec call. <div>This is for the Discovery. <br><br><div class="gmail_quote">On Fri, Jul 8, 2011 at 4:53 AM, Johnny Bufu <span dir="ltr"><<a href="mailto:jbufu@janrain.com">jbufu@janrain.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Here's the feedback I have for the Discovery draft.<br>
<br>
Johnny<br>
<br>
------------------------------<u></u>------------------------------<u></u>----<br>
Discovery (draft 01 / July 4, 2011)<br>
<br>
2. Terminology<br>
<br>
Core and OAuth 2.0 terminology is not referenced; this seems intentional, since many terms are re-defined, however not as thoroughly. Why isn't Discovery referencing them from the other specs?<br></blockquote><div><br>
</div><div>Reference. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Authorization Server is not defined.<br></blockquote><div><br></div><div>Reference. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Unique identifiers are mentioned, however the scope within which they are/should be unique is not specified.<br></blockquote><div><br></div><div>Reference through Client Identifier. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
The term Principal is overloaded:<br>
"human resource owner" in Terminology<br>
"identifier of the target end user" in Provider Discovery<br></blockquote><div><br></div><div>Reconcile and Fix. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
3. Provider Discovery<br>
<br>
"Provider discovery is optional, If a RP knows through an out of band mechinisim that all identifiers containing particular have the same issuer then they can ship this step and procede to Section 4."<br>
<br>
It's not clear what is meant by "identifiers containing particular".<br></blockquote><div><br></div><div>Delete "containing particular".</div><div><br></div><meta charset="utf-8"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Typos: mechinisim -> mechanism, ship -> skip, procede -> proceed<br></blockquote><div><br></div><div>Accept. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
"Provider discovery Simple Web Discovery requires the following information to make a discovery request:"<br>
<br>
Sentence seems to have two subjects.<br></blockquote><div><br></div><div>Accept and Fix. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
"What MUST be returned in the response is the Java origin of the Issuer."<br>
<br>
What is a Java origin?<br></blockquote><div><br></div><div>Fix. Define issuer_id tightly as "Issuers are https URI with host and port. " and use issuer_id throughout. </div><meta charset="utf-8"><div><br></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
3.1. Identifier Normalization<br></blockquote><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
The purpose and output of normalization should be made clear here (extract principal and host), rather than in the middle of a paragraph in the previous section.<br></blockquote><div><br></div><meta charset="utf-8"><div>
s/Identifier/User Identifier/ </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
"The user identifier can be one of the following: <list>"<br>
<br>
This is underspecified: unclear if the list if complete, or what else can qualify as an identifier.<br></blockquote><div><br></div><div>Clarify by adding text. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Terminology and Provider Discovery operate with generic identifiers, normalization provides a list for what can be a "user" identifier - is this intentional?<br></blockquote><div><br></div><div>As above. </div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
3.1.3. URL<br>
<br>
"If the URL does not have a "http" or "https" scheme, the string "https://" is prefixed to the URL."<br>
<br>
How is it determined that a scheme-less identifier is a URL? Terminology defines URL identifiers as either HTTP or HTTPS URIs.<br></blockquote><div><br></div><div>As above. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
4. Provider Configuration Information<br>
<br>
It is unclear if what's described in this section is optional or not:<br>
"This step is optional."<br></blockquote><div><br></div><div>Add "for the relying party."</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
"OpenID providers MUST make available a JSON document<br>
at the path .well-known/openid-<u></u>configuration."<br>
<br>
"Using the Issuer ID discoverd in Section 3"<br>
<br>
Issuer ID is not mentioned at all in Section 3.<br></blockquote><div><br></div><div>Fix. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
typos: discoverd -> discovered, retreved -> retrieved<br></blockquote><div><br></div><div>Accept. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
4.2. Provider Configuration Response<br>
<br>
typo: neccicary -> necessary<div><div></div><div class="h5"><br></div></div></blockquote><div>Accept. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div class="h5">
<br>
------------------------------<u></u>------------------------------<u></u>----<br>
______________________________<u></u>_________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.<u></u>net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/<u></u>mailman/listinfo/openid-specs-<u></u>ab</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Nat Sakimura (=nat)<br><a href="http://www.sakimura.org/en/">http://www.sakimura.org/en/</a><br><a href="http://twitter.com/_nat_en">http://twitter.com/_nat_en</a><br>
</div>