<div><div dir="auto">I missed the webfinger discussion as well, and near the end of the meeting last week, some people mentioned they would not be supporting the webfinger discovery. </div></div><div dir="auto"><br></div><div dir="auto">Given that, I think there is room for discussion.</div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Dec 17, 2019 at 3:51 PM Karl McGuinness via Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;line-break:after-white-space">
<div><span style="color:rgb(0,0,0);font-family:ProximaNova-Regular">Hello FastFed WG,</span></div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
I have been trying to post this for awhile but have had issues with mailing list permissions. The current draft spec defines an extension to Webfinger using subdomains</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<blockquote style="color:rgb(0,0,0);font-family:ProximaNova-Regular;margin:0px 0px 0px 40px;border:none;padding:0px">
<div>
<div>The subdomain location is determined by prefixing the email domain</div>
</div>
<div>
<div> with ""webfinger._well_known"". For example, if the user email is</div>
</div>
<div>
<div> ""<a href="mailto:babs@example.com" target="_blank">babs@example.com</a>"", the resulting Webfinger endpoint is</div>
</div>
<div>
<div> ""<a href="https://webfinger._well_known.example.com" target="_blank">https://webfinger._well_known.example.com</a>"".</div>
</div>
<div>
<div><br>
</div>
</div>
<div>
<div> Application Providers performing WebFinger discovery MUST first</div>
</div>
<div>
<div> attempt to read from the subdomain endpoint. If the response is not</div>
</div>
<div>
<div> an HTTP 200, the Application Provider MUST subsequently attempt</div>
</div>
<div>
<div> reading from the traditional WebFinger path at the root domain. A</div>
</div>
<div>
<div> non-normative example is illustrated in Section 4.1.2.1.2.</div>
</div>
</blockquote>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
I remember discussing this at IIW last year and wasn’t sure if we settled on this approach. I remember some folks saying that this approach wouldn't fly in IETF land. Alternative approaches such as DNS SRV or TXT records were also discussed. Folks liked
the simplicity of using DNS host records so that devs could just plop it into a connection string and the magic of the URL would do its thing.</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
We have an internal use case for discovery of an openid issuer based on email suffix where customers don’t want to host a webfinger endpoint. Customers *might* be able to delegate the entire webfinger endpoint to our SaaS using a subdomain but it might not
be something we are authoritative for for all webfinger queries.</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
We were looking at <a href="https://tools.ietf.org/html/draft-sanz-openid-dns-discovery-01" target="_blank">https://tools.ietf.org/html/draft-sanz-openid-dns-discovery-01</a> as a possible solution to serialize webfinger results in a TXT record. This removes the
need for administrators to maintain (scale, availability, etc) an endpoint for webfinger for relatively static results such as issuer which can be cached. I could see us extending this to support a fedfed tag as well. The dev friction of using TXT records
is slowly being ameliorated as DNS over HTTP becomes mainstream (see <a href="https://developers.google.com/speed/public-dns/docs/doh/json" target="_blank">https://developers.google.com/speed/public-dns/docs/doh/json</a>). I’m making assumption that the admin friction
of creating TXT records is similar to host/subdomain records which may not be true for all enterprises.</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
Is it worth rehashing this topic or has it already reached consensus in the WG? </div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:ProximaNova-Regular">
-Karl</div>
</div>
_______________________________________________<br>
Openid-specs-fastfed mailing list<br>
<a href="mailto:Openid-specs-fastfed@lists.openid.net" target="_blank">Openid-specs-fastfed@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fastfed" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fastfed</a><br>
</blockquote></div></div>