This is very good work.<div><br></div><div>I must admit that I never took a good look at artifact binding. Because I had this impression that artifact binding is about AX. Now that I have read the spec I can see that there is much more to it than AX. It looks more like a rewrite of the core protocol itself.<div>
<br></div><div>Yes I know this is going to raise some eyebrows here. But seriously, all we need to do is add webfinger to this and Viola we have OpenID V.Next.</div><div><br></div><div>(Yes I agree it is not as simple as that, but I hope you get the gist of what i am suggesting).</div>
<div><br></div><div>Also will it be possible to try this out in other languages like python, i mean can we have a trial OP setup somewhere.<br><br><div class="gmail_quote">On Tue, May 18, 2010 at 4:03 PM, Nat Sakimura <span dir="ltr"><<a href="mailto:n-sakimura@nri.co.jp">n-sakimura@nri.co.jp</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">The same with Artifact Binding 1.0 draft 06. It is a chartered work group at OpenID Foundation.<br>
(OpenID Connect / v.Next etc. needs to be chartered and approved yet.)<br>
It is very similar to David's straw man. Main difference is that you still can get the same<br>
identifier as OpenID 2.0. It also is a trivially implementable spec.<br>
<br>
See here: <a href="https://openid4.us/" target="_blank">https://openid4.us/</a> for links etc.<br>
<br>
Cheers,<br>
<br>
=nat<div><div></div><div class="h5"><br>
<br>
<br>
(2010/05/17 22:27), Alex Barth wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Small aside: I've implemented a similar workflow myself recently and I've avoided any changes of user account details on Relying Parties:<br>
<br>
<a href="http://developmentseed.org/blog/2010/mar/02/simple-sign-openid" target="_blank">http://developmentseed.org/blog/2010/mar/02/simple-sign-openid</a><br>
<br>
All changes to accounts properties (user name, email, etc) are done on the provider to avoid asynchronicities.<br>
<br>
Alex<br>
<br>
On May 17, 2010, at 12:03 AM, Manuel Lemos wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
With this thread of using oAuth 2 for identity I am confused to which<br>
protocol should I use for a single sign-on solution that I need to<br>
implement.<br>
<br>
Let me explain my case and see if anybody can clarify what is the best<br>
solution for me.<br>
<br>
I have one site, lets call it site A, that has many user accounts. I<br>
want to build another site, lets call it site B, but I do not want users<br>
with accounts in site A to create new accounts to access site B. They<br>
could just use the same account data from site A and use it in site B.<br>
In the future I may have sites C, D, etc..<br>
<br>
I thought of creating an OpenID authentication server, lets call it OP,<br>
and migrate user account from site A to OP. When users go to site A or B<br>
and need to login, they are redirected via OpenID to OP for authentication.<br>
<br>
If successful, OP passes site A or B the account, personal name, nick<br>
name and e-mail when redirecting back to sites A or B, so those sites<br>
always have copies of that account information for imediate use.<br>
<br>
If the user updates one of those details in site A or B, they push the<br>
changes to OP and OP propagates the changes to the other site A or B<br>
that also has the same user account.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
From the specifications that I read, OpenID and its extensions can be<br>
</blockquote>
used the way I need.<br>
<br>
This will all be used only within my network sites. I do not intend to<br>
allow users to autheticate with external OpenID providers, nor I want<br>
other sites to use my OpenID provider to authenticate in other sites.<br>
<br>
Since this is meant for use restricted to my sites, I could invent a<br>
proprietary protocol, but I thought it was better to not reinvent the wheel.<br>
<br>
I will develop all the necessary components to implement the OpenID<br>
provider and consumers with the needed extensions. Actually the consumer<br>
component is mostly done.<br>
<br>
I was moving to the OpenID provider component when I noticed this thread<br>
of using oAuth 2 for identity. So now I wonder if I am in the right<br>
path? Shall I keep doing it with OpenID or shall I do it with oAuth 2?<br>
Can anybody please shed some light so I can make the best decision?<br>
<br>
-- <br>
<br>
Regards,<br>
Manuel Lemos<br>
<br>
Find and post PHP jobs<br>
<a href="http://www.phpclasses.org/jobs/" target="_blank">http://www.phpclasses.org/jobs/</a><br>
<br>
PHP Classes - Free ready to use OOP components written in PHP<br>
<a href="http://www.phpclasses.org/" target="_blank">http://www.phpclasses.org/</a><br>
_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net" target="_blank">specs@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</blockquote>
<br>
Alex Barth<br>
<a href="http://www.developmentseed.org/blog" target="_blank">http://www.developmentseed.org/blog</a><br>
tel (202) 250-3633<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net" target="_blank">specs@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</blockquote>
<br>
<br></div></div>
-- <br>
Nat Sakimura<br>
<br>
$B$3$N%a!<%k$K$O!"K\Mh$N08@h$NJ}$N$_$K8BDj$5$l$?5!L)>pJs$,4^$^$l$F$$$k>l(B<br>
$B9g$,$4$6$$$^$9!#$*?4$"$?$j$N$J$$>l9g$O!"Aw?.<T$K$4O"Mm$N$&$(!"$3$N%a!<(B<br>
$B%k$r:o=|$7$F$/$@$5$$$^$9$h$&$*4j$$?=$7>e$2$^$9!#(B<br>
PLEASE READ$B!'(BThis e-mail is confidential and intended for the named re<br>
cipient only. If you are not an intended recipient, please notify the<br>
sender and delete this e-mail.<div><div></div><div class="h5"><br>
<br>
<br>
_______________________________________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net" target="_blank">specs@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><a href="http://hi.im/santosh">http://hi.im/santosh</a><br><br><br>
</div></div>