<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Actually, to your point 3 Dick, OpenID Connect has defined a simple mechanism for IdPs to share claims from third parties.
<a href="http://openid.net/specs/openid-connect-framework-1_0.html#anchor9">Section 4.2 of the Framework spec</a> defines how to represent Aggregated Claims and Distributed Claims, where Aggregated Claims are third party claims passed by value and Distributed
Claims are third party claims passed by reference.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I agree that having the mechanism is only part of the solution, as a usable user experience for this functionality is also needed.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> -- Mike<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: openid-specs-bounces@lists.openid.net [mailto:openid-specs-bounces@lists.openid.net] On Behalf Of Dick Hardt<br>
Sent: Wednesday, July 20, 2011 6:31 AM<br>
To: Manger, James H<br>
Cc: OpenID Specs Mailing List<br>
Subject: Re: Mozilla BrowserID</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">John: A user-centric architecture has the user's agent in the middle of identity transactions. There are some pictures in the slides I show in my short presentation linked here:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><a href="http://dickhardt.org/2010/12/oidf-2010/"><span style="color:windowtext;text-decoration:none">http://dickhardt.org/2010/12/oidf-2010/</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In OpenID Connect, the user gives authorizes the RP to call an API at the IdP to retrieve information about the user. I call this a service-centric model. There are a number of significant disadvantages of this model:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">1) there are unsolved UX challenges to the user seeing what identity data the RP will get from the IdP.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">2) if the user has multiple equivalent attributes, there is no UX for asking the user which one to provide the RP, so either they are all provided, or just one. Eg. the user may have multiple postal addresses, and different ones will
be appropriate for different RPs.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">3) No simple mechanism has been specified on how the IdP can share claims from 3rd parties. In a user-centric model, the user agent can pull claims from multiple parties to satisfy an identity request from the user.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">James: OpenID Connect does have dynamic client spec:<o:p></o:p></p>
<p class="MsoPlainText"> <a href="http://openid.net/specs/openid-connect-registration-1_0.html">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-registration-1_0.html</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Time will tell if any IdP will support it for acquiring identity data. (for that matter, I have not yet seen any major IdP announce support for OpenID Connect)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The map that Nat created here:<o:p></o:p></p>
<p class="MsoPlainText"> <a href="http://openid.net/2011/07/15/current-map-for-openid-connect/">
<span style="color:windowtext;text-decoration:none">http://openid.net/2011/07/15/current-map-for-openid-connect/</span></a><o:p></o:p></p>
<p class="MsoPlainText">helps to navigate.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 2011-07-19, at 11:05 PM, Manger, James H wrote:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">>>> As for one of the major advantages of BrowserID: it is a user-centric architecture unlike OpenID Connect.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">>> Can you explain what you mean by "user-centric" in this context?<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> With OAuth2 (and hence OpenID Connect, I assume) the RP needs to be registered with the IdP. It is not user-centric because the user cannot arbitrarily choose an IdP -- they can only choose an IdP with whom the RP is registered, which
may well mean only one of a handful of major IdPs.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> BrowserID is user-centric in that the RP can verify the signature of whichever email provider the user chooses. It doesn't rely on a prior agreements between the RP and IdP.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText">> James Manger<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">specs mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:specs@lists.openid.net"><span style="color:windowtext;text-decoration:none">specs@lists.openid.net</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.openid.net/mailman/listinfo/openid-specs"><span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>