<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: Building identity on top of OAuth
2.0?</title></head><body>
<div>>Unless I'm misunderstanding, that will work with the OpenID
Connect proposal.</div>
<div>></div>
<div>>I have <a
href="https://davidrecordon.com/">https://davidrecordon.com/</a> and
have signed up for Example Server which lets me specify a custom user
identifier. LRDD on <a
href="http://davidrecordon.com">davidrecordon.com</a> points to the
token endpoint on <a
href="https://example-server.com/">https://example-server.com/</a>.
Example Server then issues <a
href="https://davidrecordon.com/">https://davidrecordon.com/</a> as
the user identifier.</div>
<div><br></div>
<div>Then, reading "Example Server" as
"http://example-server.com/", it seems like an extra step of
user-verification for the RP would be prudent: "Your unique URL
is reported as the OP's, click OK to have this be your permanent
associable identifier on the web, click Cancel if you wanted
another."</div>
<div><br></div>
<div>Or the OP could have pre-associated, so the custom user
identifier should be up-front when account linking is about to take
place.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>