Gabe Wachob wrote: > Hi Mart- > I'm trying to figure out if what you are proposing covers the same > use case that I discussed at > http://openid.net/pipermail/general/2007-March/002005.html > I'm not clear actually what you are trying to do with HTTP > Authentication, and it may be completely unrelated to my use case, or it > could be squarely in the same place. > In your proposal, is there any interaction with a user? If so, when? > All I see is that the "caller" sends a signature with the authenticated > request. Is this implying that the "caller" performs some function with the > OP to generate this signature? How does this happen? Can I use an existing > OP with my URL or XRI to generate this signature? If so, how? >
The HTTP authentication bit does not specify how the signature is obtained. This is because when some application service is authenticating as itself it can maintain its own associations and generate its own signature without the indirection. Where the Signature Request Protocol comes in is making this protocol applicable to user authentication as well. Unfortunately, it *does* require the OP to support an additional protocol mode where the user is authenticated using HTTP authentication (or some other machine-interpretable authentication) rather than HTML forms and redirections. The flow I'm expecting for the latter is, to take the Last.fm client[1] as an example, that the user will enter an identifier URI into the preferences dialog where currently a username/password is entered. When the client-side app needs to make a request, it'll first do an unauthenticated request and see what HTTP authentication mechanisms are supported, and then prompt the user for appropriate credentials. In the future, I'm hoping that the signature-fetching steps will be replaced with "call into an installed system service which will prompt the user to release a signature", thus avoiding the need for the user to give up the credentials to the client app and allowing the user to approve each application is is often done with a desktop firewall. [1] http://www.last.fm/tools/downloads/ _______________________________________________ specs mailing list specs@openid.net http://openid.net/mailman/listinfo/specs