<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yes the spec recommends using the host portion only for calculating the PPID. If that is a concern for the AS it could always use the path as well. <div class=""><br class=""></div><div class="">Making the file a .well-known is not a bad idea. Unfortunately it didn’t come up at the time. In fact getting anyone to have any interest in pairwise identifiers was a challenge at times. </div><div class=""><br class=""></div><div class="">Perhaps that is something we could consider for a future update. We could simply say the sector identifier needs to be in .well-known but still use the host name.</div><div class="">That would stop random customer content from being used to insert a bogus sector identifier.</div><div class=""><br class=""></div><div class="">I think the reason that we didn’t use the full path was to allow the client some flexibility in moving the file.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 15, 2016, at 1:20 PM, Thomas Broyer <<a href="mailto:t.broyer@gmail.com" class="">t.broyer@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="">On Tue, Mar 15, 2016 at 3:37 PM John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" class="">ve7jtb@ve7jtb.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">They would all need to provide the same sector_identifier_uri during registration.<br class=""></blockquote><div class=""><br class=""></div><div class="">This is not what's written.</div><div class=""><br class=""></div><div class="">What's written is that they would need to provide the same Sector Identifier, which is the host part of the sector_identifier_uri. So different sector_identifier_uri can share the same Sector Identifier, and as a result an attacker could use a vulnerability (or possibly even a "feature" –user-contributed content) on the victim server to serve its own JSON file containing its own redirect_uris, then sharing the same Sector Identifier, thus now receiving the same pairwise sub identifiers as the victim.</div><div class="">Using a .well-known would mean that only one such JSON file can exist for a particular Sector Identifier, therefore making the Sector Identifier and sector_identifier_uri relationship a 1:1 rather than 1:n.</div><div class=""> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">The file at the sector identifier would need to contain both redirect URI.<br class=""><br class="">This is under the control of the RP to show that the sites are related. You don’t want any site to be able to use your sector identifier to do correlation.<br class=""><br class="">The AS could have some administrative rule that sites are related and override the logic but that is likely not to be manageable over time.<br class=""><br class="">John B.<br class=""><br class=""><br class="">> On Mar 14, 2016, at 1:30 PM, Mike Schwartz <<a href="mailto:mike@gluu.org" target="_blank" class="">mike@gluu.org</a>> wrote:<br class="">><br class="">> James,<br class="">><br class="">> In the Gluu Server we just implemented interfaces to make it easier for domain admins to publish sector_identifier_uri's. How could a single sector_identifier_uri work if you have multiple partners which you want to issue distinct pairwise identifiers?<br class="">><br class="">> - Mike<br class="">><br class="">><br class="">> -------------------------------------<br class="">> Michael Schwartz<br class="">> Gluu<br class="">> Founder / CEO<br class="">><br class="">> _______________________________________________<br class="">> Openid-specs-ab mailing list<br class="">><span class="Apple-converted-space"> </span><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" class="">Openid-specs-ab@lists.openid.net</a><br class="">><span class="Apple-converted-space"> </span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class=""><br class="">_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" class="">Openid-specs-ab@lists.openid.net</a><br class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote></div></div></div></blockquote></div><br class=""></div></body></html>