<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
I just found out that our XRD/Webfinger support in production is
broken. This boils down to deployment issues for me since the owner
of the aol.com domain is the portal team, not the identity team. As
more and more specs are putting files in /.well-known I'm looking
for solutions that are less brittle that what I have right now. With
that context, is it acceptable to deploy a static file to
<a class="moz-txt-link-freetext" href="https://aol.com/.well-known/simple-web-discovery">https://aol.com/.well-known/simple-web-discovery</a> that returns...<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<pre class="newpage"> {
"SWD_service_redirect":
{
"location": <a class="moz-txt-link-rfc2396E" href="https://api.screenname.aol.com/swd_server">"https://api.screenname.aol.com/swd_server"</a>,
"expires": 1300752001
}
}</pre>
That static file would ignore the query parameters though they will
be logged. Note that if the SWD request is for an @aim.com domain
the JSON response will be the same. <br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<pre class="newpage"> GET /.well-known/simple-web-discovery
?principal=<a class="moz-txt-link-freetext" href="mailto:joe@aim.com">mailto:joe@aim.com</a>
&service=urn:example.org:service:calendar HTTP/1.1
Host: aim.com
HTTP/1.1 200 OK
Content-Type: application/json
{
"SWD_service_redirect":
{
"location": <a class="moz-txt-link-rfc2396E" href="https://api.screenname.aol.com/swd_server">"https://api.screenname.aol.com/swd_server"</a>,
"expires": 1300752001
}
}
</pre>
<br>
I'm assuming there are no trust chain issues if the redirect
location does NOT match the root domain of the original request.<br>
<br>
Finally, the expiration field is going to cause me problems. I
really would like the file to be static, but the client to requery
every n hours/days/weeks. This could be done using HTTP expiration
semantics. However, I don't have a deployment solution that allows
me to update the file on a fixed interval. I'll keep exploring
options to make it more dynamic, but the dynamic flow I have right
now has been broken twice by config upgrades.<br>
<br>
Thanks,<br>
George<br>
</body>
</html>