<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Hi Nat,<br>
    <br>
    <div class="moz-cite-prefix">Am 24.09.2014 15:49, schrieb Nat
      Sakimura:<br>
      <br>
    </div>
    <blockquote
cite="mid:CABzCy2DejFaxAzD4eE6M6g1VNjNWGPNFVVDq3h3TXbmATS3VZA@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote">
            <div> </div>
            ...
            <div> </div>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div text="#000000" bgcolor="#FFFFFF"> <br>
                "There could be an attack by a malicious RP to obtain
                the user’s PPID for another RP to perform identity
                correlation. To mitigate the risk, the OP MUST verify
                that the realm and RP’s Redirect URI matches as per
                Section 9.2 of OpenID 2.0 [OpenID.2.0]."<br>
                <br>
                I'm not sure what this means. Does it mean the RP's XRDS
                document must contain the RP’s Redirect URI (a
                OAuth/OIDC redirect_uri)? If so, is the RP supposed to
                use a certain service Type or <a moz-do-not-send="true"
                  href="http://specs.openid.net/auth/2.0/return_to"
                  target="_blank">"http://specs.openid.net/auth/2.0/return_to"</a>?<br>
                <br>
                Example:<br>
                <Service xmlns="xri://$xrd*($v*2.0)"><br>
                  <Type><a moz-do-not-send="true"
                  href="http://specs.openid.net/auth/2.0/return_to"
                  target="_blank">http://specs.openid.net/auth/2.0/return_to</a></Type><br>
                  <URI><a moz-do-not-send="true"
                  href="http://consumer.example.com/return"
                  target="_blank">http://consumer.example.com/return</a></URI><br>
                </Service><br>
              </div>
            </blockquote>
            <div><br>
            </div>
            <div>It just means that openid2_realm MUST be (roughly) a
              substring of OpenID Connect/OAuth's Redirect URI. No XRDS
              is involved. Exact rule of the matching is given in
              Section 9.2 of OpenID 2.0. <br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    It's probably nitpicking, but the OIDC redirect_uri must be matched
    using the rules given in Section 9.2 of OpenID 2.0 instead of the
    OpenId 2.0 return_to URI, correct?<br>
    <br>
    best regards,<br>
    Torsten.<br>
    <br>
    <br>
  </body>
</html>