<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [PROPOSAL] authentication age</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>That was going to be my exact follow-up to my own message, though got distracted. What I phrased was how Dick described it.<BR>
<BR>
I like the feature, though agree that many IdPs may be unable to implement it due to how they do session handling. It could be augmented to also contain a response parameter telling the RP if the IdP acknowledged it, then the RP could make the decision if it wants to proceed.<BR>
<BR>
--David<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: specs-bounces@openid.net on behalf of Martin Atkins<BR>
Sent: Sun 10/1/2006 12:07 PM<BR>
To: specs@openid.net<BR>
Subject: Re: [PROPOSAL] authentication age<BR>
<BR>
Recordon, David wrote:<BR>
> No, IdP MUST perform and RP MAY include.<BR>
><BR>
<BR>
IdP implementations that are embedded into some other app might have<BR>
trouble implementing this. Take LiveJournal, for example: what should it<BR>
do in the case where it has to re-authenticate? End the user's LJ<BR>
session and force them to log in again? Duplicate the login code in the<BR>
OpenID server code?<BR>
<BR>
Aside from that qualm, this is another one of those things where it's<BR>
pointless to make it a MUST since IdPs that don't implement it aren't<BR>
going to get punished in any way. If IdPs can get away without doing it,<BR>
and RPs can't tell that they have, then some/most IdPs just won't<BR>
bother. Sure, it reduces the usefulness of this feature, but this<BR>
feature is riding on a completely uncheckable assumption and is<BR>
therefore broken by design.<BR>
<BR>
The best we can do is make it a MAY (that is, max_age is a *suggestion*<BR>
from the RP) and hope that most IdPs do the right thing; we shouldn't<BR>
write the spec in a way that misleads RP implementers into thinking<BR>
they've actually got any real control here.<BR>
<BR>
_______________________________________________<BR>
specs mailing list<BR>
specs@openid.net<BR>
<A HREF="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</A><BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>