<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Discovery depends upon Simple Web Discovery [SWD]. Is there a posted rationale for the choice of SWD over LRDD (See [host-meta]) anywhere?</div><div><br></div><div>SWD does have the notable advantage of being simpler (as may be expected given its title), however</div><div><ul class="MailOutline"><li>It has poorly defined delegation caching semantics (It is undefined how SWD's delegation caching is intended to interact with the caching mechanisms built into the HTTP protocol). </li><li>It has onerous requirements on the user - "the caller MUST redirect all SWD requests for that domain to until the expires time has passed." implies that the caller is required to maintain a cache of all redirections it has received for the given time period. This is not likely to be feasible</li><li>It has a hard requirement on HTTPS, thus making it hard to genericise to applications which do not require the security required by OpenID</li></ul><div><br></div></div><div>In combination with the OpenID Connect Discovery specification, this has other issues:</div><div><ul class="MailOutline"><li>It is impossible to make revisions to the discovery specification which change the service type without requiring multiple requests for backwards compatibility</li><li>Related to the above, it requires that end users perform multiple requests if they wish to find more information about the user</li></ul><div><br></div></div><div>It would make sense to me for OpenID Connect to build upon [WebFinger], as</div><div><ul class="MailOutline"><li>Several major providers, including Google and Yahoo, have already implemented WebFinger support for their user accounts. </li><li>The same LRDD request that would be used to discover the OpenID Connect endpoint can be used to gather other useful information about a user</li><li>LRDD is easily extended in order to support discovery of new endpoint types - and can already be used (via an informal specification) to discover OpenID 2.0 endpoints</li><li>Many applications which would benefit from the integration with OAuth brought about by OpenID Connect (such as [OStatus]) have already standardised upon LRDD and WebFinger</li></ul><div><br></div></div><div>As an example case where LRDD provides useful additional functionality, I can see web applications theoretically supporting the following functionality: </div><div><ul class="MailOutline"><li>User is provided with a "web identity" text box into which they can enter</li><ul><li>An "E-Mail address-like" ID (e.g. <a href="mailto:user@example.com">user@example.com</a>), to be looked up using WebFinger</li><li>An "URL-like address" (e.g. <a href="http://example.com/user">example.com/user</a>), to be looked up using LRDD after prepending http[s]</li><li>A fully formed URL, to be directly looked up using LRDD</li><ul><li>(A todo issue: in the URL-like cases, should we fall back to parsing HTML link elements to support delegation?)</li></ul></ul><li>Some client side JavaScript, as the user types, uses XMLHttpRequest in order to perform lookups on these entered addresses</li><li>A popup can appear below the login box saying "Login as <your name>", featuring the user's name and avatar, automatically gathered by performing a PortableContacts lookup for the user</li><li>When the user presses enter, or the login button, the authentication flow can be started quickly as the JavaScript code on the client has already done some of the hard work</li></ul><div><br></div></div><div>I do not believe that the simplifications made by SWD over LRDD are warranted or wise, and would much prefer to see OpenID Connect revised to build upon the WebFinger and host-meta specifications. </div><div><br></div><div>== References (where not included in the discussed specification)</div><div>[host-meta]<span class="Apple-tab-span" style="white-space:pre"> <a href="http://tools.ietf.org/html/rfc6415">http://tools.ietf.org/html/rfc6415</a></span></div><div>[WebFinger]<span class="Apple-tab-span" style="white-space:pre"> <a href="http://tools.ietf.org/html/draft-jones-appsawg-webfinger-00">http://tools.ietf.org/html/draft-jones-appsawg-webfinger-00</a></span></div><div>[OStatus]<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ostatus.org/">http://ostatus.org/</a></div><div><br></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">-- Owen Shepherd<br><a href="http://www.owenshepherd.net/">http://www.owenshepherd.net/</a><br>owen.shepherd@e43.eu<br></span>
</div>
<br></body></html>