Unless I'm misunderstanding, that will work with the OpenID Connect proposal.<div><br></div><div>I have <a href="https://davidrecordon.com/">https://davidrecordon.com/</a> and have signed up for Example Server which lets me specify a custom user identifier. LRDD on <a href="http://davidrecordon.com">davidrecordon.com</a> points to the token endpoint on <a href="https://example-server.com/">https://example-server.com/</a>. Example Server then issues <a href="https://davidrecordon.com/">https://davidrecordon.com/</a> as the user identifier.</div>
<meta charset="utf-8"><div><br></div><div>Or of course I could run all of this myself on <a href="http://davidrecordon.com">davidrecordon.com</a> via SSL.</div><div><br></div><div>--David</div><div><br><br><div class="gmail_quote">
On Sun, May 16, 2010 at 3:00 PM, SitG Admin <span dir="ltr"><<a href="mailto:sysadmin@shadowsinthegarden.com">sysadmin@shadowsinthegarden.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The second is the actual user identifier. This is what needs to be hosted over SSL if it's a URL and is ultimately what clients use to distinguish between users.<br>
</blockquote>
<br></div>
The shift, as I understand it, is from a URI/OP delegation model (where the OP is assumed to have exercised due diligence in keeping the user's identity secure, but RP's rely on the URI being secure), to an OP model (where RP's rely on the OP being secure). The essence of this shift is that you have removed the (presumed-to-be) insecure *URI*, which delegated *to* OP's.<br>
<br>
I propose modifying this shift/split: continue focusing on this reliance upon the *OP* to be secure, but also leave room for a *URI* being primary *if and only if* that URI (which delegates to OP's) is *also* served over SSL.<br>
<br>
The essence of this modification would be a split between the concepts of "secure identifier" and "convenience of identifying": both concentrated in the OP by default, but if you want to have a URI that you trust as "secure identifier" (however difficult it is to effect any changes this way), and an OP that serves for day-to-day business, this is acceptable too.<br>
<br>
-Shade<br>
</blockquote></div><br></div>