Sounds like you're simply mapping a SL UUID to an OpenID, so my opinion would be "no, this does not break the spec", so long as the actual OpenID transaction utilizes the OpenID URL that you have on file in the DB.<br>
<br>This is very similar to the other discussions going on regarding using an email address in-lieu of a user's OpenID, since in the real world the email address is the identifier users are arguably most familiar with (currently, anyway). Note here that "mapping" to an email address does not break the spec, but there is talk of ammending the spec to make email addresses actual OpenID's. <br>
<br>david<br><br><div class="gmail_quote">On Mon, Nov 17, 2008 at 1:46 AM, SignpostMarv Martin <span dir="ltr"><<a href="mailto:signpostmarv.martin@slopenid.net">signpostmarv.martin@slopenid.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Just polling for feedback on a bit of a non-standard login mechanism<br>
I've implemented on my site(s).<br>
<br>
<br>
1) a user logs into Second Life, and clicks a kiosk to get a nonced URL.<br>
2) the user gets a fairly standard OpenID form, submitting their OpenID<br>
(I'm using the Zend libraries, btw)<br>
3) once successfully logged in via OpenID, the endpoint and avatar UUID<br>
are recorded in a db table<br>
* after this point, the OpenID url will never be entered again (unless<br>
the user wishes to change their OpenID, or perhaps for circumstances<br>
where an additional security/paranoia requirement is desired)<br>
4) the user visit a SLOpenID v3-enabled website, entering their Second<br>
Life avatar name<br>
5) the code checks if the name is valid, on file, and if it has an<br>
OpenID associated<br>
6) the code then automagically submits the OpenID that is on file to the<br>
Zend libs (as opposed to accepting a POST or GET value)<br>
<br>
<br>
Do note that Linden Lab don't (currently) have an OpenID provider, and<br>
since I retired SLOpenID v2, I don't believe there are any that cater<br>
solely to Second Life Residents- though there isn't really much point in<br>
it any more, considering flickr, live journal and blogger all act as<br>
providers (all of which are used by Second Life Residents to varying<br>
degrees).<br>
<br>
<br>
The purpose of only using the Second Life name is three-fold:<br>
<br>
1) Residents are familiar with entering their SL name (in either<br>
first/last format or a single string) in several places throughout<br>
Linden Lab's presence (viewer, websites)<br>
2) To strive for a possible standardisation across SL-centric websites,<br>
increasing people's awareness of possible phishing attacks (see footnote)<br>
3) To strive for a possible learned behaviour of passwordless,<br>
transparent OpenID logins in Second Life viewers (OpenID is mentioned as<br>
a possibility for OGP logins)<br>
<br>
<br>
So my question is this: Is using OpenID without the user entering the<br>
actual OpenID url breaking the spec ?<br>
<br>
<br>
~ Marv.<br>
<br>
<br>
*phishing footnote<br>
If there are no passwords entered on a SLOpenID v3-enabled website,<br>
there is no risk of the maintainer of said site being accused of<br>
manipulating users so that they can collect the actual Second Life<br>
passwords. If the SLOpenID v3 method were to become commonplace amongst<br>
SL-centric websites, otherwise-uninformed users (e.g. those that use<br>
SL-centric services) would be immediately less trusting of phishing<br>
sites that specifically target SL users (e.g. OH HAI! U CAN HAS FREE L$<br>
IF U ENTER UR PASSWORDS! KTHXBAI MUAHAHAHA)<br>
<br>
<br>
p.s. this email has been BCC'd to the OpenID mailing list and LL peeps,<br>
just in case you're wondering why the text of the email is rather verbose.<br>
<br>
_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@openid.net">specs@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/specs" target="_blank">http://openid.net/mailman/listinfo/specs</a><br>
</blockquote></div><br>