<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">So I would answer that
question as...<br>
<br>
The user who owns the *@gmail.com account does have an account at
AOL but they do so via Facebook. AOL would have the standard
OAuth2 direct relationship with Facebook based on the Facebook
user id (I'm assuming that's how that relationship would be
established).<br>
<br>
In the consumer case, it's possible to just rely on the direct
relationships and trust that any implicit ones will propagate
through the direct one in a timely manner.<br>
<br>
So back to my example. If something happens at Google to
*@gmail.com, then Facebook would get notified and if that triggers
something at Facebook, AOL would get notified via the Facebook
path. I do think it helps in this use case that Facebook is
effectively acting as an IdP for the user (Facebook does an
authentication).<br>
<br>
The Enterprise example is a little more complicated because in
that case there is only one entity that is authenticating the user
because Google is delegating authentication to the enterprise IdP.
Take an example where ACME Corp uses Google Apps but does it's own
authentication, and an ACME Corp employee uses Google to log into
Slack. Slack as an RP has a direct relationship with Google.
Google has a direct relationship with ACME IdP. Should we again
rely on propagation of events through the direct relationship
paths?<br>
<br>
Thanks,<br>
George<br>
</font><br>
<div class="moz-cite-prefix">On 11/22/16 4:15 PM, Hardt, Dick wrote:<br>
</div>
<blockquote
cite="mid:08707E77-A5A0-4CCD-9781-B00433B273A6@amazon.com"
type="cite">
<pre wrap="">George: does the *@gmail.com user have an account at AOL? Let’s assume that is the use case you are talking about. It is not clear how Facebook and AOL are going to learn they share a user. In the F2F we talked about direct relationships would proxy in same way for indirect relationships. Ie. AOL would share data with Google, and Facebook would share data with Google. If there is an event at Facebook that is shared with Google, then that may create an event at Google that would be shared with Facebook.
/Dick
On 11/22/16, 9:50 AM, someone claiming to be "Openid-specs-risc on behalf of George Fletcher" <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-risc-bounces@lists.openid.netonbehalfofgffletch@aol.com"><openid-specs-risc-bounces@lists.openid.net on behalf of gffletch@aol.com></a> wrote:
Hi,
Given that at AOL we are a relying party to Google, Facebook, Yahoo,
Twitter, LinkedIn, etc. ... when a user logs in via Facebook with an
email address of *@gmail.com, should AOL subscribe at both Facebook and
Google? or just Facebook?
This is similar to the enterprise case we talked about in the F2F. In
that case it was someone logging in via Google with an identity that is
not authenticated by Google but rather by the owning enterprise domain.
Thoughts?
Thanks,
George
_______________________________________________
Openid-specs-risc mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-risc@lists.openid.net">Openid-specs-risc@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-risc">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a>
</pre>
</blockquote>
<br>
</body>
</html>