<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:715013284;
mso-list-type:hybrid;
mso-list-template-ids:1366731804 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple style='word-wrap: break-word;
-webkit-nbsp-mode: space;-webkit-line-break: after-white-space'>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>John,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I believe the claimed ID should be the same URI as is used today.
That is, an email address should be mapped via WebFinger into an the claimed ID.
Reasons:<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>This helps to ensure backward-compatibility<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>The claimed ID can be easily discovered via WebFinger<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>3)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>The URI would not have to be entered directly by the user to
login if we use WebFinger<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>4)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>We do not lose any security benefits of the current OpenID spec,
since authentication would still be against the existing OpenID URI<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Paul <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> openid-specs-bounces@lists.openid.net
[mailto:openid-specs-bounces@lists.openid.net] <b>On Behalf Of </b>John Bradley<br>
<b>Sent:</b> Wednesday, May 12, 2010 5:48 PM<br>
<b>To:</b> Santosh Rajan<br>
<b>Cc:</b> openid-specs@lists.openid.net<br>
<b>Subject:</b> Re: OpenID V.Next - Some Views to Consider<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Webfinger is a profile of LRDD that allows this new thing
called an account URI (We shall make the assumption for the moment that it gets
registered and is a URI) to be resolved via LRDD to a XRD.<o:p></o:p></p>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>The important thing WebFinger provides is a way to determine
the root of authority for a Acct URI. (The host to start discovery on)<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>In principal any URI with a host segment can use LRDD to get
a XRD. <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>I suppose other types of URI could define some other root
for discovery as well. <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>So if openID supports LRDD then normalization rules for
Acct: and other URI schemes could be specified so that they to can be resolved
to a XRD.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>The question will be for the core protocol what to use as
the claimed_id. <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>There are three schools of thought.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>1 The normalized input identifier<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>2 The Subject of the XRD<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>3 The claimed_id that the OP returns.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>There are arguments to be made for all three.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>I expect this to be addressed in the WG.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>John B.<o:p></o:p></p>
<div>
<div>
<p class=MsoNormal>On 2010-05-12, at 12:34 PM, Santosh Rajan wrote:<o:p></o:p></p>
</div>
<p class=MsoNormal><br>
<br>
<o:p></o:p></p>
<p class=MsoNormal>Starting a new thread here based on an earlier one quoted
below.<o:p></o:p></p>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Let us reconsider the definition of OpenID for V.next. I
would like to see a new definition for OpenID.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>"An OpenID is Any Valid URI that can be resolved to
it's Descriptor".<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Now let me give a little explanation on the above, with a
few points.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>1) Existing OpenID's version 1 and 2 are compatible with the
above definition. (http(s) OpenId's version 1 and 2 do resolve to their
descriptor's)<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>2) Email like identifiers are compatible with the above
definition with the webfinger protocol, and ofcourse resolve to their
descriptor's.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Now any other future protocol that can make its URI
resolvable to a descriptor, will also be a Valid OpenID. Let me give an
example.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>According to the above definition we can make "tag
URI's" valid OpenID's, as long as we have a protocol to resolve this URI
to its's descriptor.<o:p></o:p></p>
</div>
<div>
<div style='mso-element:para-border-div;border:dashed #2F6FAB 1.0pt;padding:
12.0pt 12.0pt 12.0pt 12.0pt;background:#F9F9F9'><pre style='line-height:13.2pt;
background:#F9F9F9;border:none;padding:0in'><span style='color:black'><a
href="mailto:tag%3Auser@example.com">tag:user@example.com</a>,2007-11-02:Tag_URI<o:p></o:p></span></pre></div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Now as far as I am concerned tag URI's are even better as
OpenID's, because they are unique over space and time.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Webfinger support for tag URI's anyone? :-)<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'>---------- Forwarded message
----------<br>
From: <b>Paul E. Jones</b> <<a href="mailto:paulej@packetizer.com">paulej@packetizer.com</a>><br>
Date: Wed, May 12, 2010 at 8:11 AM<br>
Subject: RE: Draft charter for v.Next Attributes working group<br>
To: Santosh Rajan <<a href="mailto:santrajan@gmail.com">santrajan@gmail.com</a>><br>
Cc: Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>>,
<a href="mailto:jsmarr@stanfordalumni.org">jsmarr@stanfordalumni.org</a>, <a
href="mailto:openid-specs@lists.openid.net">openid-specs@lists.openid.net</a>, <a
href="mailto:tech-comm@openid.net">tech-comm@openid.net</a><br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Santosh,</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Why not store the claimed ID in the
webfinger (LRDD) XRD document?</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>The objective, I would hope, is to make
it easier to log into web sites. Email-style identifiers make that
easier, but the system does not have to be built around those.</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>So, I sign up with a service
provider. Let’s just use my own site as an example. I am
assigned an email address <a href="mailto:paulej@packetizer.com" target="_blank">paulej@packetizer.com</a>.
Behind the scenes, I am also assign an OpenID ID <a
href="http://openid.packetizer.com/paulej" target="_blank">http://openid.packetizer.com/paulej</a>.
Now, when I visit a web site, I can type ‘<a
href="mailto:paulej@packetizer.com" target="_blank">paulej@packetizer.com</a>’
and the site can perform a webfinger query to discovery by OpenID ID. We
would define a link relation (something we’ve talked about before) that
represents openid. It could be <a href="http://openid.net/identity"
target="_blank">http://openid.net/identity</a> or it could be simply
“openid” (since link relations need not be URIs). Looking at
the href of the “openid” link relation, one would find my OpenID
URI <a href="http://openid.packetizer.com/paulej" target="_blank">http://openid.packetizer.com/paulej</a>.</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Now, should I wish to have a different
email provider than my openid provider, that’s fine: I could change the
record associated with the openid link relation to contain a different OpenID
identifier. Alternatively, I could just get an account at <a
href="http://someopenidop.com/" target="_blank">someopenidop.com</a> and they
might assign an e-mail style address like <a
href="mailto:paulej@someopenidop.com" target="_blank">paulej@someopenidop.com</a>
and perform the Webfinger resolution behind the scenes.</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Anyway, issue this request:</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>$ curl <a
href="http://www.packetizer.com/lrdd/?uri=acct:paulej@packetizer.com"
target="_blank">http://www.packetizer.com/lrdd/?uri=acct:paulej@packetizer.com</a></span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>You’ll see the link relation for
my claimed ID:</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'><Link
rel="<a href="http://openid.net/identity" target="_blank">http://openid.net/identity</a>"</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>
href="<a href="http://openid.packetizer.com/paulej" target="_blank">http://openid.packetizer.com/paulej</a>"/></span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>It does introduce another protocol, but
I think these play nicely together. The real identity would remain the
URL that OpenID uses today. The email identifier would just be an alias
for it.</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Paul</span><o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.0pt'>From:</span></b><span style='font-size:10.0pt'>
Santosh Rajan [mailto:<a href="mailto:santrajan@gmail.com" target="_blank">santrajan@gmail.com</a>]
<br>
<b>Sent:</b> Tuesday, May 11, 2010 12:39 PM<br>
<b>To:</b> Paul E. Jones<br>
<b>Cc:</b> Mike Jones; <a href="mailto:jsmarr@stanfordalumni.org"
target="_blank">jsmarr@stanfordalumni.org</a>; <a
href="mailto:openid-specs@lists.openid.net" target="_blank">openid-specs@lists.openid.net</a>;
<a href="mailto:tech-comm@openid.net" target="_blank">tech-comm@openid.net</a><br>
<b>Subject:</b> Re: Draft charter for v.Next Attributes working group</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div style='margin-bottom:12.0pt'>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On
Tue, May 11, 2010 at 8:55 AM, Paul E. Jones <<a
href="mailto:paulej@packetizer.com" target="_blank">paulej@packetizer.com</a>>
wrote:<o:p></o:p></p>
<div>
<div>
<div>
<p class=MsoNormal><span style='font-size:11.5pt;color:#1F497D'> </span><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Adding support for email-style addresses
is something I like, but something that can be provided via webfinger.
Thus, no change to the base protocol.</span><o:p></o:p></p>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I
beg to disagree here. I think the base protocol needs to address the issue of
email like identifiers. I would like to see that email like identifiers are
valid OpenID claimed id's.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>So
something like acct:example @ <a href="http://example.com/" target="_blank">example.com</a>
should be a valid OpenID claimed_id.<o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Also
this discussion should not be in this thread (about attributes) and maybe someone
could start a new thread on this subject.<o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Santosh<o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><a
href="http://hi.im/santosh" target="_blank">http://hi.im/santosh</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
<br clear=all>
<br>
-- <br>
<a href="http://hi.im/santosh">http://hi.im/santosh</a><br>
<br>
<o:p></o:p></p>
</div>
<p class=MsoNormal>_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net">specs@lists.openid.net</a><br>
http://lists.openid.net/mailman/listinfo/openid-specs<o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>