<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [PROPOSAL] authentication age</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>I like this, though think minutes would be granular enough. Just to clarify, since it took me reading it a few times...<BR>
<BR>
Add an optional request parameter openid.auth_age which is a positive integer. This parameter allows the relying party to request that if the identity provider has not renewed the session with the user in the past X minutes, that it do so at this time. If left out of the request, it is assumed that a session of any age is acceptable for the transaction. If 0, the RP is requesting authentication be done on this request no matter the age of the session.<BR>
<BR>
Assuming this be added, it would have to be a MUST in the spec to be useful.<BR>
<BR>
--David<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: specs-bounces@openid.net on behalf of Dick Hardt<BR>
Sent: Sat 9/30/2006 5:04 PM<BR>
To: specs@openid.net<BR>
Subject: [PROPOSAL] authentication age<BR>
<BR>
Motivating Use Case:<BR>
----------------------------<BR>
<BR>
Different RPs will require different amounts of certainty about the <BR>
user, and at times will have different requirements depending on what <BR>
the user is doing. Eg. from existing web applications today. There is <BR>
little concern when the user is getting personalized pages and a <BR>
relatively old cookie may be adequate but the app will require the <BR>
user to provide their password when changing their settings.<BR>
<BR>
Proposed Implementation<BR>
-----------------------------------<BR>
<BR>
New, optional parameter in the request, "openid.auth_age" where the <BR>
value is the number of seconds (minutes?) since the user last <BR>
provided credentials. If the it has been longer since then that the <BR>
IdP authenticated the user, then the IdP MUST authenticate the user <BR>
again. A value of zero (0) means that the IdP MUST prompt the user <BR>
for credentials.<BR>
<BR>
Issues<BR>
--------<BR>
There is no way to force an IdP to authenticate the user, but a <BR>
"good" IdP implementation will follow the requests of the RP<BR>
<BR>
_______________________________________________<BR>
specs mailing list<BR>
specs@openid.net<BR>
<A HREF="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</A><BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>