<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Duty compels me to point out an existing XML-based architecture for SSO
that has support for smart-clients<br>
<br>
<a class="moz-txt-link-freetext" href="http://en.wikipedia.org/wiki/SAML">http://en.wikipedia.org/wiki/SAML</a><br>
<br>
paul<br>
<br>
Dick Hardt wrote:
<blockquote cite="mid:07A6C179-C08A-4082-8820-254929E4DA1E@gmail.com"
type="cite">Designing OpenID around a particular product is clearly a
non-starter.
<div><br>
</div>
<div>Enabling smart clients was discussed as part of OpenID 2.1 at
IIW. </div>
<div><br>
</div>
<div>Smart clients can:</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span> reduce
the phishing risk of malicious RPs</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>improve
the user experience by simplifying the flow</div>
<div><span class="Apple-tab-span" style="white-space: pre;"> </span>improve
the performance by reducing the number of HTTP calls.<br>
</div>
<div><br>
</div>
<div>We will still need to continue to support dumb browsers and
hence browser redirects and form submission.</div>
<div><br>
</div>
<div>-- Dick</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
<div>
<div>On 17-Dec-08, at 7:38 AM, Doğa Armangil wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">I think that OpenID auth would benefit from
Qworum in a broad sense, because Qworum aims to address the needs of a
class of services called "multi-phase services", which includes OP-type
services. <br>
<br>
Having said that, two concrete benefits immediately come to mind:<br>
<br>
1. Simplified OP<br>
Currently the OP does two things: (1) it provides core authentication
functionality, and (2) it takes care of integrating itself into the
calling RP by keeping track of the return address. <br>
When Qworum is used, the non-core task (2) is handled by the user
agent, and the OP can concentrate on providing only the core
functionality.<br>
<br>
2. Robust message semantics<br>
With Qworum, authentication request and response messages are XML
documents. Needless to say, XML is a mature and powerful messaging
format. The one benefit of XML that I will mention here is that it
allows the use of namespaces for qualifying OpenID request parameters
and response fields (instead of the "openid." prefix). Example:<br>
<br>
<message xmlns:openid='<a moz-do-not-send="true"
href="http://openid.net/">http://openid.net/</a>'><br>
<openid:mode>checkid_setup</openid:mode><br>
...<br>
</message><br>
<br>
My general impression regarding the OpenID-Qworum link is that it just
makes sense.<br>
<br>
<br>
<div class="gmail_quote">2008/12/16 David Fuelling <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:sappenin@gmail.com">sappenin@gmail.com</a>></span><br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Cool idea, although I wonder what benefit this would bring to OpenID
auth? Seems like HTTP redirects and form submits work pretty well
today. Would Qworum enable any sort of new features that aren't
possible today because we're not using XML between RP/OP/User-agent?<br>
<br>
Thanks!<br>
<br>
david<br>
<br>
<div class="gmail_quote">2008/12/15 Doğa Armangil <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:doga.armangil@gmail.com"
target="_blank">doga.armangil@gmail.com</a>></span><br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div class="Wj3C7c"> The OpenID Authentication 2.0
specification states in section 5.2 that "There are two methods for
indirect communication: HTTP redirects and HTML form submission". It is
worth noting that a third method might be added to this list: Qworum ( <a
moz-do-not-send="true" href="http://www.qworum.com/" target="_blank">http://www.qworum.com/</a>
).<br>
<br>
Qworum is a fairly new technology (a couple of years old) that aims to
solve precisely the problem of indirect communication between
interactive web services (such as between Relying Parties and OpenID
Providers). Qworum mandates that the caller (i.e. RP) and the callee
(i.e. OP) communicate through XML documents.<br>
<br>
Here is one possible authentication scenario involving Qworum:<br>
<br>
<br>
1. The RP calls the OP by sending the following Qworum message to the
user agent:<br>
<br>
<!-- Return to the RP after calling the OP --><br>
<qrm:goto href='/auth_complete' xmlns:qrm='<a moz-do-not-send="true"
href="http://www.qworum.com/" target="_blank">http://www.qworum.com/</a>'><br>
<br>
<!-- Call the OP --><br>
<qrm:call href='<a moz-do-not-send="true"
href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a>'><br>
<br>
<!-- Authentication request message --><br>
<message xmlns:openid='<a moz-do-not-send="true"
href="http://openid.net/" target="_blank">http://openid.net/</a>'><br>
<openid:mode>checkid_setup</openid:mode><br>
<openid:identity><a moz-do-not-send="true"
href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br>
...<br>
</message><br>
<br>
</qrm:call><br>
<br>
</qrm:goto><br>
<br>
This message instructs the user agent to call the OP and to send the
result back to the RP.<br>
<br>
2. The user agent then calls the OP (i.e. <a moz-do-not-send="true"
href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a>
) by POSTing it the following XML document:<br>
<br>
<message xmlns:openid='<a moz-do-not-send="true"
href="http://openid.net/" target="_blank">http://openid.net/</a>'><br>
<openid:mode>checkid_setup</openid:mode><br>
<openid:identity><a moz-do-not-send="true"
href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br>
...<br>
</message><br>
<br>
3. The OP interacts with the end user.<br>
<br>
4. The OP sends the following Qworum message to the user agent:<br>
<br>
<!-- Authentication response message --><br>
<message xmlns:openid='<a moz-do-not-send="true"
href="http://openid.net/" target="_blank">http://openid.net/</a>'><br>
<openid:mode>id_res</openid:mode><br>
<openid:identity><a moz-do-not-send="true"
href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br>
...<br>
</message><br>
<br>
5. Finally, the user agent then POSTs the authentication response
message back to the RP. Note that the RP return address is handled by
the user agent, not the OP.<br>
<br>
<br>
Adding Qworum as a third communication method would not break existing
methods, it would just offer one more choice to RPs:<br>
* The RP can check whether the user agent has Qworum capability by
inspecting the Accept header of the HTTP request. The RP can then
choose to use Qworum.<br>
* The OP would understand that the RP is using Qworum to call it if the
Content-Type of the HTTP POST request is application/xml.<br>
<br>
So my question is this: Has Qworum been considered for indirect
communication, or could it be considered in the future? (As the lead
developer of Qworum, I can affirm that Qworum would do all it can to
facilitate this process.)<br>
<br>
-- <br>
<font color="#888888">Doğa Armangil<br>
<br>
</font><br>
</div>
</div>
_______________________________________________<br>
specs mailing list<br>
<a moz-do-not-send="true" href="mailto:specs@openid.net"
target="_blank">specs@openid.net</a><br>
<a moz-do-not-send="true"
href="http://openid.net/mailman/listinfo/specs" target="_blank">http://openid.net/mailman/listinfo/specs</a><br>
<br>
</blockquote>
</div>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Doğa Armangil<br>
<br>
_______________________________________________<br>
specs mailing list<br>
<a moz-do-not-send="true" href="mailto:specs@openid.net">specs@openid.net</a><br>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</a><br>
</blockquote>
</div>
<br>
</div>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
specs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:specs@openid.net">specs@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</a>
</pre>
<pre wrap="">
<hr size="4" width="90%">
No virus found in this incoming message.
Checked by AVG.
Version: 7.5.552 / Virus Database: 270.9.19/1853 - Release Date: 17/12/2008 8:31 AM
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<font size="-1">Paul Madsen<br>
e:paulmadsen @ ntt-at.com<br>
p:613-482-0432<br>
m:613-282-8647<br>
web:connectid.blogspot.com<br>
</font><a href="http://feeds.feedburner.com/%7Er/blogspot/gMwy/%7E6/1"><img
src="cid:part1.03070901.03060506@rogers.com" alt="ConnectID"
style="border: 0pt none ;"></a></div>
</body>
</html>