<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The XRDS discovery spec is defined by the XRI 2.0 spec as profiled by Yadis.<div><br></div><div>There is a new discovery spec that converges XRDS Simple as used in oAuth, Yadis and XRI.</div><div><br></div><div>That is the XRD 1.0 spec currently under development in the XRI TC at OASIS. </div><div><br></div><div>There will need to be a profile of the discovery spec as part of openID 2.1 if that is desired.</div><div><br></div><div>Google, Yahoo and others are contributing the XRD spec. </div><div><br></div><div>There are references in openID 2.0 and the extensions on what needs to go in to a XRDS, but there is no comprehensive profile of XRDS for openID that defines where new Services or extension elements are added.</div><div><br></div><div>I agree that communicating RP TOS and Privacy via RP Discovery is a likely candidate.</div><div><br></div><div>The CX (contract exchange) workgroup is also looking at some of the same issues where those policies need to be signed by the user.</div><div><br></div><div>I know that is a requirement in Europe for accessing government sites, from my conversations with the people from the STORK initiative.</div><div><a href="http://www.eid-stork.eu/">http://www.eid-stork.eu/</a></div><div><br></div><div>We may need lightweight policy display and the more heavyweight signing ability that CX brings to the table to work across all the use cases from different jurisdictions.</div><div><br></div><div>John B.</div><div><br><div><div>On 2-Jun-09, at 1:56 PM, <a href="mailto:specs-request@openid.net">specs-request@openid.net</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="color: rgb(0, 0, 0); font-family: -webkit-monospace; font-size: 10px; ">Date: Tue, 02 Jun 2009 10:55:55 -0700<br>From: Allen Tom <<a href="mailto:atom@yahoo-inc.com">atom@yahoo-inc.com</a>><br>Subject: Re: SREG's Privacy Policy URL<br>To: Luke Shepard <<a href="mailto:lshepard@facebook.com">lshepard@facebook.com</a>>, "<a href="mailto:specs@openid.net">specs@openid.net</a>"<br><span class="Apple-tab-span" style="white-space: pre; "> </span><<a href="mailto:specs@openid.net">specs@openid.net</a>><br>Message-ID: <<a href="mailto:4A2567AB.10606@yahoo-inc.com">4A2567AB.10606@yahoo-inc.com</a>><br>Content-Type: multipart/alternative;<br><span class="Apple-tab-span" style="white-space: pre; "> </span>boundary="------------060606030309050004000507"<br><br>This is a multi-part message in MIME format.<br>--------------060606030309050004000507<br>Content-Type: text/plain; charset=ISO-8859-1; format=flowed<br>Content-Transfer-Encoding: 7bit<br><br>Hi Luke,<br><br>Yes, this is what we're looking for. Currently, in OpenID, the only way<span class="Apple-converted-space"> </span><br>for the RP to link to its privacy policy (which is sort of like linking<span class="Apple-converted-space"> </span><br>to its ToS) is by passing it in the openid.sreg.policy_url parameter<span class="Apple-converted-space"> </span><br>using SREG.<br><br>Since we're trying to deprecate SREG, we can try to move this parameter<span class="Apple-converted-space"> </span><br>to either the UI or AX Extension, or move it into Discovery.<br><br>Is there an actual Discovery spec?<br><br>Allen<br><br><br>Luke Shepard wrote:<br><blockquote type="cite">FWIW, Facebook Connect allows relying parties to define a "terms of<span class="Apple-converted-space"> </span><br></blockquote><blockquote type="cite">service" url. We then show that link to users when they click on it.<span class="Apple-converted-space"> </span><br></blockquote><blockquote type="cite">With OpenID, the equivalent URL would be set using relying party<span class="Apple-converted-space"> </span><br></blockquote><blockquote type="cite">discovery. Is this more or less what you're looking for?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Screenshot:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote></span><br class="Apple-interchange-newline"></blockquote></div><br></div></body></html>