<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nat, should this comment result in an editorial correction to the draft before it’s republished?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> Torsten Lodderstedt [mailto:torsten@lodderstedt.net]
<br>
<b>Sent:</b> Saturday, October 04, 2014 8:12 AM<br>
<b>To:</b> Nat Sakimura<br>
<b>Cc:</b> Mike Jones; specs@lists.openid.net<br>
<b>Subject:</b> Re: Review of Proposed Implementer’s Draft of OpenID 2.0 to OpenID Connect Migration Specification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Nat,<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Am 24.09.2014 15:49, schrieb Nat Sakimura:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">... <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><br>
"There could be an attack by a malicious RP to obtain the user’s PPID for another RP to perform identity correlation. To mitigate the risk, the OP MUST verify that the realm and RP’s Redirect URI matches as per Section 9.2 of OpenID 2.0 [OpenID.2.0]."<br>
<br>
I'm not sure what this means. Does it mean the RP's XRDS document must contain the RP’s Redirect URI (a OAuth/OIDC redirect_uri)? If so, is the RP supposed to use a certain service Type or
<a href="http://specs.openid.net/auth/2.0/return_to" target="_blank">"http://specs.openid.net/auth/2.0/return_to"</a>?<br>
<br>
Example:<br>
<Service xmlns="xri://$xrd*($v*2.0)"><br>
<Type><a href="http://specs.openid.net/auth/2.0/return_to" target="_blank">http://specs.openid.net/auth/2.0/return_to</a></Type><br>
<URI><a href="http://consumer.example.com/return" target="_blank">http://consumer.example.com/return</a></URI><br>
</Service><o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It just means that openid2_realm MUST be (roughly) a substring of OpenID Connect/OAuth's Redirect URI. No XRDS is involved. Exact rule of the matching is given in Section 9.2 of OpenID 2.0.
<o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
It's probably nitpicking, but the OIDC redirect_uri must be matched using the rules given in Section 9.2 of OpenID 2.0 instead of the OpenId 2.0 return_to URI, correct?<br>
<br>
best regards,<br>
Torsten.<br>
<br>
<o:p></o:p></p>
</div>
</body>
</html>