Here are some additional pieces of information about Qworum, which hopefully address your comments:<br><br>1. Qworum is an open web specification<br>At its heart, Qworum is a web format rather than a product. We intend to make sure that this is and remains an open format, and we welcome constructive criticism in this regard. We are likely to resolve any shortcomings in a matter of days. As an indication of our openness, let me mention that browser providers are free to integrate Qworum capability into their software; we provide certification services to support this process.<br>
Qworum intends to always maintain a clear separation between this open format and any products that may be derived from it.<br><br>2. Qworum-enabled browsers as "dumb" clients<br>Qworum provides a general purpose web format (comparable to HTML) rather than a special purpose one. A browser with Qworum capability is then arguably a "dumb" client, and would not qualify as a smart client.<br>
<br>Finally, the use of Qworum for indirect communication would be optional, which greatly reduces the reliance of OpenID on Qworum.<br><br><br><div class="gmail_quote">On Wed, Dec 17, 2008 at 5:59 PM, Dick Hardt <span dir="ltr"><<a href="mailto:dick.hardt@gmail.com">dick.hardt@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style="">Designing OpenID around a particular product is clearly a non-starter.<div><br>
</div><div>Enabling smart clients was discussed as part of OpenID 2.1 at IIW. </div><div><br></div><div>Smart clients can:</div><div><span style="white-space: pre;"> </span> reduce the phishing risk of malicious RPs</div>
<div><span style="white-space: pre;"> </span>improve the user experience by simplifying the flow</div><div><span style="white-space: pre;"> </span>improve the performance by reducing the number of HTTP calls.<br></div><div>
<br></div><div>We will still need to continue to support dumb browsers and hence browser redirects and form submission.</div><div><br></div><font color="#888888"><div>-- Dick</div></font><div><div></div><div class="Wj3C7c">
<div><br></div><div><br></div><div><br><div><div>On 17-Dec-08, at 7:38 AM, Doša Armangil wrote:</div><br><blockquote type="cite">I think that OpenID auth would benefit from Qworum in a broad sense, because Qworum aims to address the needs of a class of services called "multi-phase services", which includes OP-type services. <br>
<br>Having said that, two concrete benefits immediately come to mind:<br> <br>1. Simplified OP<br>Currently the OP does two things: (1) it provides core authentication functionality, and (2) it takes care of integrating itself into the calling RP by keeping track of the return address. <br>
When Qworum is used, the non-core task (2) is handled by the user agent, and the OP can concentrate on providing only the core functionality.<br> <br>2. Robust message semantics<br>With Qworum, authentication request and response messages are XML documents. Needless to say, XML is a mature and powerful messaging format. The one benefit of XML that I will mention here is that it allows the use of namespaces for qualifying OpenID request parameters and response fields (instead of the "openid." prefix). Example:<br>
<br> <message xmlns:openid='<a href="http://openid.net/" target="_blank">http://openid.net/</a>'><br> <openid:mode>checkid_setup</openid:mode><br> ...<br> </message><br><br>
My general impression regarding the OpenID-Qworum link is that it just makes sense.<br> <br><br><div class="gmail_quote">2008/12/16 David Fuelling <span dir="ltr"><<a href="mailto:sappenin@gmail.com" target="_blank">sappenin@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Cool idea, although I wonder what benefit this would bring to OpenID auth? Seems like HTTP redirects and form submits work pretty well today. Would Qworum enable any sort of new features that aren't possible today because we're not using XML between RP/OP/User-agent?<br>
<br>Thanks!<br><br>david<br><br><div class="gmail_quote">2008/12/15 Doša Armangil <span dir="ltr"><<a href="mailto:doga.armangil@gmail.com" target="_blank">doga.armangil@gmail.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div> The OpenID Authentication 2.0 specification states in section 5.2 that "There are two methods for indirect communication: HTTP redirects and HTML form submission". It is worth noting that a third method might be added to this list: Qworum ( <a href="http://www.qworum.com/" target="_blank">http://www.qworum.com/</a> ).<br>
<br>Qworum is a fairly new technology (a couple of years old) that aims to solve precisely the problem of indirect communication between interactive web services (such as between Relying Parties and OpenID Providers). Qworum mandates that the caller (i.e. RP) and the callee (i.e. OP) communicate through XML documents.<br>
<br>Here is one possible authentication scenario involving Qworum:<br><br><br>1. The RP calls the OP by sending the following Qworum message to the user agent:<br><br><!-- Return to the RP after calling the OP --><br>
<qrm:goto href='/auth_complete' xmlns:qrm='<a href="http://www.qworum.com/" target="_blank">http://www.qworum.com/</a>'><br><br> <!-- Call the OP --><br> <qrm:call href='<a href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a>'><br>
<br> <!-- Authentication request message --><br> <message xmlns:openid='<a href="http://openid.net/" target="_blank">http://openid.net/</a>'><br> <openid:mode>checkid_setup</openid:mode><br>
<openid:identity><a href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br> ...<br> </message><br><br> </qrm:call><br><br>
</qrm:goto><br><br>This message instructs the user agent to call the OP and to send the result back to the RP.<br><br>2. The user agent then calls the OP (i.e. <a href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a> ) by POSTing it the following XML document:<br>
<br><message xmlns:openid='<a href="http://openid.net/" target="_blank">http://openid.net/</a>'><br> <openid:mode>checkid_setup</openid:mode><br> <openid:identity><a href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br>
...<br></message><br><br>3. The OP interacts with the end user.<br><br>4. The OP sends the following Qworum message to the user agent:<br><br><!-- Authentication response message --><br><message xmlns:openid='<a href="http://openid.net/" target="_blank">http://openid.net/</a>'><br>
<openid:mode>id_res</openid:mode><br> <openid:identity><a href="http://openid-provider.net/my_id" target="_blank">http://openid-provider.net/my_id</a></openid:identity><br> ...<br></message><br>
<br>5. Finally, the user agent then POSTs the authentication response message back to the RP. Note that the RP return address is handled by the user agent, not the OP.<br> <br><br>Adding Qworum as a third communication method would not break existing methods, it would just offer one more choice to RPs:<br>
* The RP can check whether the user agent has Qworum capability by inspecting the Accept header of the HTTP request. The RP can then choose to use Qworum.<br> * The OP would understand that the RP is using Qworum to call it if the Content-Type of the HTTP POST request is application/xml.<br>
<br>So my question is this: Has Qworum been considered for indirect communication, or could it be considered in the future? (As the lead developer of Qworum, I can affirm that Qworum would do all it can to facilitate this process.)<br>
<br>-- <br><font color="#888888">Doša Armangil<br><br> </font><br></div></div>_______________________________________________<br> specs mailing list<br> <a href="mailto:specs@openid.net" target="_blank">specs@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/specs" target="_blank">http://openid.net/mailman/listinfo/specs</a><br> <br></blockquote></div><br> </blockquote></div><br><br clear="all"><br>-- <br>Doša Armangil<br><br> _______________________________________________<br>
specs mailing list<br><a href="mailto:specs@openid.net" target="_blank">specs@openid.net</a><br><a href="http://openid.net/mailman/listinfo/specs" target="_blank">http://openid.net/mailman/listinfo/specs</a><br></blockquote>
</div><br></div></div></div></div></blockquote></div><br><br clear="all"><br>-- <br>Doša Armangil<br><br>