<div dir="ltr"><div><div><div>Yes to me it feels right to just say that openid2_id is the OpenID 2.0 Claimed Identifier.<br><br></div>What I don't fully understand yet is whether in the OIDC world the Authorization Endpoint would be hosted 1. at <a href="https://xri.net/some/path">https://xri.net/some/path</a>, or 2. individually by the i-brokers.<br>
<br></div>If 1., then for the migration spec I think no discovery step would be needed, since the issuer would always be <a href="https://xri.net">https://xri.net</a> anyway, no?<br><br></div>What would the "iss" and "sub" fields be for an ID token issued for an XRI?<br>
<div><br>Markus<br><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Aug 25, 2014 at 6:25 PM, Nat Sakimura <span dir="ltr"><<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Having said that, it is probably better to have the canonical XRI itself in the openid2_id. <div>Note though, Canonical ID only exists for XRI. In all other cases, it is the Verified Claimed ID. </div>
<div>In XRI's case, the value of the Canonical ID is used as the verified Claimed Identifier. </div>
<div>So, in general, just stating that openid2_id is OpenID 2.0 Identifier suffices. </div><div><br></div><div>We would however have to add text to the discovery portion. </div><div><br></div><div>In http(s) case, there is no change. </div>
<div>For XRI case, it has to be prefixed by <a href="https://xri.net/" target="_blank">https://xri.net/</a>. </div><div><br></div><div>My question to Markus at this point is how realistic that <a href="http://xri.net" target="_blank">xri.net</a> will implement this feature. </div>
<div>Do you have any idea? </div><div><br></div><div>Nat</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-08-26 0:31 GMT+09:00 Nat Sakimura <span dir="ltr"><<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>></span>:<div>
<div class="h5"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">That would actually complicate 90% of the cases where openid2_id is a http(s) URI. <div>And I probably was a bit sleepy when I wrote the last response. </div>
<div>It is not xri://<a href="http://xri.net/" target="_blank">xri.net/</a> obviously. </div>
<div>I meant <a href="https://xri.net/" target="_blank">https://xri.net/</a> etc. so that the discovery process would be uniform to the RPs. </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-08-25 23:44 GMT+09:00 Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span>:<div>
<div><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I prefer the alternative that Markus is suggesting, in which we always use the OpenID 2.0 canonical identifier as the openid2_id claim value. In fact, I would
consider adding his example, in which this claim value is shown:<u></u><u></u></span></p>
<p class="MsoNormal">"openid2_id": "<b>=!91F2.8153.F600.AE24</b>"<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">We should then describe how to prefix this value to perform discovery, rather than removing the prefix.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Nat Sakimura<br>
<b>Sent:</b> Monday, August 25, 2014 7:26 AM<br>
<b>To:</b> Markus Sabadello<br>
<b>Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-ab] Some comments on OpenID 2.0 to OpenID Connect Migration spec<u></u><u></u></span></p><div><div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Thanks Markus, <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I created tickets based on these comments. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This particular one is: <a href="https://bitbucket.org/openid/connect/issue/950/migration-te-4-xri-portion-needs-change-by" target="_blank">https://bitbucket.org/openid/connect/issue/950/migration-te-4-xri-portion-needs-change-by</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">For the relying party, I think it would be relatively straight forward to strip xri:// from openid2_id if they stored XRI as pure CanonicalID and causes less confusion than trying to figure out the type of openid2_id by sniffing if it starts
from "=" or "!" or "@" etc. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This comment thus seem to imply that we should add some text in section 7, e.g., adding: <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">If the OpenID 2.0 Identifier starts with xri://<a href="http://xri.net/" target="_blank">xri.net/</a> then the relying party MUST extract the Canonical XRI by stripping "xri://<a href="http://xri.net/" target="_blank">xri.net/</a>" from the beginning of the OpenID 2.0
Identifier. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">What do you think? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Nat<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2014-08-23 21:36 GMT+09:00 Markus Sabadello <<a href="mailto:markus.sabadello@gmail.com" target="_blank">markus.sabadello@gmail.com</a>>:<u></u><u></u></p>
<div>
<p>In section 4:<u></u><u></u></p>
<p>"For XRI, OpenID 2.0 Identifier MUST be created as <a href="https://xri.net/" target="_blank">
https://xri.net/</a> concatenated with the user’s verified XRI without the xri:// scheme. "<u></u><u></u></p>
<p>The problem with this I think is that in OpenID 2.0, for an XRI the Claimed Identifier is the pure CanonicalID (I-Number), without https:// or xri:// scheme. For example, an RP might have
<b>=!91F2.8153.F600.AE24</b> as the Claimed Identifier (openid2_id) for a user in its database.<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">So I think in section 4, we should either not say anything specific at all about XRI, or say something like this:<br>
<br>
"For XRI, OpenID 2.0 Identifier MUST be the content of the <CanonicalID> element, as specified in [OpenID.2.0]"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Then an example ID Token would be:<u></u><u></u></p>
<pre>{<u></u><u></u></pre>
<pre> "iss": "?? not sure",<u></u><u></u></pre>
<pre> "sub": "?? not sure",<u></u><u></u></pre>
<pre> "aud": "s6BhdRkqt3",<u></u><u></u></pre>
<pre> "nonce": "n-0S6_WzA2Mj",<u></u><u></u></pre>
<pre> "exp": 1311281970,<u></u><u></u></pre>
<pre> "iat": 1311280970,<u></u><u></u></pre>
<pre> "openid2_id": "<b>=!91F2.8153.F600.AE24</b>"<u></u><u></u></pre>
<pre>}<u></u><u></u></pre>
<p class="MsoNormal">But then I can see that obtaining an "iss" as described in sections 2 and 6 won't work.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><br>
<br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div></div></div>
</div>
</blockquote></div></div></div><div><div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div></div></div>
</blockquote></div></div></div><div><div class="h5"><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div></div></div>
</blockquote></div><br></div>