<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Arial Unicode MS";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@Arial Unicode MS";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0cm;
margin-right:0cm;
margin-bottom:6.0pt;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Arial Unicode MS";
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Arial Unicode MS";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-AU link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>James Henstridge,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:Arial;color:black'>>
why wouldn't this alternative [doing it all at the OP] be appropriate?</span><span
style='font-size:10.0pt;font-family:"Arial Unicode MS";color:blue'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>It would be great if OPs offered lots of functionality (such as per-User
per-RP policies), while remaining simple to use and understand. The great
feature of OpenID is that is allows each user to choose login policies they are
happy with without requiring explicit support by the RP. It would be even
better if any user can choose login policies without requiring explicit support
by a single OP for all the possibilities.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>> You are trading
complexity at the OP end for complexity at the discovery/delegation end.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>Being able to trade complexity at one point against another is a
GOOD thing. You can pick whichever is less complex to you. Others can pick
whichever is less complex to them.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>The proposed change is not at all complex: an RP simply adds one more
HTTP header with a fixed (for the RP) value. The discovery end does not have to
do anything – it is just easier for them if they want to do something a little
different.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>> 1. using an OP that
is not publicly accessible for certain operations<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>> 2. using an RP that
will only authenticate people using a particular OP.</span><span
style='color:blue'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>These are additional use cases that highlight how useful knowing
the RP during discovery (eg via a From field) could be. Now we have 3 use cases
for this 1 simple feature.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'><o:p> </o:p></span></p>
<blockquote style='margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'>
<p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
color:black'>_____________________________________________<br>
<b>From:</b> james.henstridge@gmail.com [mailto:james.henstridge@gmail.com] <b>On
Behalf Of </b>James Henstridge<br>
<b>Sent:</b> Wednesday, 17 October 2007 5:26 PM<br>
<b>To:</b> Manger, James H<br>
<b>Cc:</b> specs@openid.net</span><span style='color:blue'><o:p></o:p></span></p>
<p class=MsoNormal><span style='color:blue'><o:p> </o:p></span></p>
<blockquote style='margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:maroon'>OPs can offer different
authentication mechanisms</span><span style='color:blue'><o:p></o:p></span></p>
</blockquote>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>If the primary aim is
just to let the user set a policy on how carefully they should be authenticated
when talking to particular RPs, why wouldn't this alternative be appropriate?<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:blue'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>You are trading
complexity at the OP end for complexity at the discovery/delegation end.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:blue'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'>Or are you trying to
address a slightly different problem? Maybe one of:<o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='font-size:10.0pt;font-family:Arial;color:black'> 1. using an OP that is
not publicly accessible for certain operations 2. using an RP that will only
authenticate people using a particular OP.</span><span style='font-size:10.0pt;
font-family:Arial;color:blue'><o:p></o:p></span></p>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span
style='color:blue'><o:p> </o:p></span></p>
<div class=MsoNormal align=center style='margin-bottom:0cm;margin-bottom:.0001pt;
text-align:center'><span lang=EN-US>
<hr size=2 width="100%" align=center tabindex=-1>
</span></div>
<p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><b><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>From:</span></b><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> Manger, James H <br>
<b>Sent:</b> Wednesday, 17 October 2007 12:59 PM<br>
<b>To:</b> 'specs@openid.net'<br>
<b>Subject:</b> [OpenID] identify RP when it gets OpenID URL</span><span
lang=EN-US><o:p></o:p></span></p>
<p class=MsoNormal><span style='color:blue'>…</span><span style='font-size:
10.0pt;font-family:"Arial Unicode MS"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS"'>Add
the following paragraph at the end of section 7.3 Discovery:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS"'>“The
Relying Party MUST include a From HTTP header field in each HTTP request made
during discovery. The From field holds an email address for the RP (eg From: <a
href="mailto:openid@example.net">openid@example.net</a>) [RFC2616]. This
enables the discovered information to vary based on the RP. The From field is
not authenticated so it is not appropriate to use for access control.”<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial Unicode MS";
color:blue'>…<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:-36.0pt'><span style='font-size:10.0pt;
font-family:"Arial Unicode MS"'><o:p> </o:p></span></p>
</blockquote>
</div>
</body>
</html>