<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
In the registered consumer case, why not just do:<br>
<br>
openid.assoc_handle=consumer_key<br>
openid.mac_key=consumer_secret<br>
<br>
?<br>
<br>
In the unregistered consumer case, the OpenID association request could
be extended to hand out Consumer keys, which are then used as the
association handle. The scopes and realm could be passed to the
association request as well.<br>
<br>
<br>
Allen<br>
<br>
<br>
<br>
Dirk Balfanz wrote:
<blockquote
cite="mid:60c552b80811131416k22ac2874k1141244bc9270a4e@mail.gmail.com"
type="cite">Yes, I can see how that would happen. <br>
<br>
So how about for OPs who tie scope to Consumer Keys, their
openid.oauth.scope syntax would look something like this:<br>
<br>
openid.oauth.scope=consumer_key:scope1,scope2,scope3<br>
<br>
Or, if there is a one-to-one mapping from consumer_key to scope, simply
like this:<br>
<br>
openid.oauth.scope=consumer_key<br>
<br>
Dirk.<br>
<br>
<div class="gmail_quote">On Thu, Nov 13, 2008 at 2:04 PM, Darren
Bounds <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:darren@cliqset.com">darren@cliqset.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#FFFFFF">
<div>Certainly but the consumer context you display to the user is
falsely represented based solely on the realm in that circumstance.
<div class="Ih2E3d"><br>
<br>
Sent from a mobile device.</div>
</div>
<div>
<div class="Wj3C7c">
<div><br>
On Nov 13, 2008, at 4:58 PM, Dirk Balfanz <<a moz-do-not-send="true"
href="mailto:balfanz@google.com" target="_blank">balfanz@google.com</a>>
wrote:<br>
<br>
</div>
<blockquote type="cite">
<div><br>
<br>
<div class="gmail_quote">On Thu, Nov 13, 2008 at 1:45 PM, Allen
Tom <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:atom@yahoo-inc.com" target="_blank">atom@yahoo-inc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Dirk Balfanz wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
I don't think this is true - I believe the realm is sufficient. Let me
try and explain. (We'll assume registered consumers.) On the approval
page, we need to identify the consumer. In its current form, the spec
basically assumes that you're gonna use the realm for that.<br>
</blockquote>
<br>
</div>
You're assuming that a realm has only one CK. A site might have
multiple consumer keys, with different scopes attached to them...<br>
<font color="#888888"></font></blockquote>
<div><br>
Actually, I wasn't assuming that. At access token request time, you
follow the map from consumer-key to realm (that's the direction you can
do, right)? If that's a many-to-one map then this will give you one
realm. Then you check whether that's the realm that the request token
was issued to.<br>
<br>
The one thing you're losing is that you can't, at approval time, figure
out whether that realm is requesting a scope that they have access to.
So a realm could ask for a certain scope in their auth request, the
user approves it, and then at access-token-request time, you won't
issue the token b/c they're using a CK that doesn't have enough
privileges. It's still secure, but gives you a crappy user experience
if the consumer mixes up their CKs.<br>
<br>
Wait - I think I have an idea: what if the Yahoo-specific way of
requesting the scope is to include the CK into the openid.oauth.scope
parameter? That way, you can at approval time make sure that they are
requesting a scope that they are actually authorized to pick up. This
wouldn't be for security purposes - just as a way to make sure the user
experience isn't surprising.<br>
<br>
Dirk.<br>
</div>
</div>
<br>
</div>
</blockquote>
</div>
</div>
<div class="Ih2E3d">
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>specs mailing list</span><br>
<span><a moz-do-not-send="true" href="mailto:specs@openid.net"
target="_blank">specs@openid.net</a></span><br>
<span><a moz-do-not-send="true"
href="http://openid.net/mailman/listinfo/specs" target="_blank">http://openid.net/mailman/listinfo/specs</a></span><br>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<br>
</blockquote>
<br>
</body>
</html>