Subject: Re: OpenID+GSS-API and naming: GSS_C_NT_OPENID?

From: Martin Rex <[email-masked]>
Date: Thu, 5 Aug 2010 01:21:34 +0200 (MEST)

Simon Josefsson wrote:
> 
> I currently have the following text, is there any feedback from GSS-API
> people on it?
> 
> It seems useful to specify a GSS-API name attribute for the normalized
> OpenID identifier, if that is an appropriate use of name attributes.
> Thoughts?

I have not been following the details -- what exactly do you mean by
GSS-API name attribute (something that doesn't exist in the base GSS-API
architecture)?

There should be a mechanism-specific nametype defined for an OpenID
GSS-API mechanism along with a canonical representation (and guidance
on how to perform name canonicalization), so that applications can
create ACLs based on this and these ACLs remain independent of a
particular implementation (instead useable for all versions of
that mechanisms and ultimately for independent implementations
of the OpenID gssapi mechanism).

-Martin

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 05 Aug 2010 01:34:45 +0200

> GSS-API name attribute (something that doesn't exist in the base GSS-API

See http://tools.ietf.org/html/draft-ietf-kitten-gssapi-naming-exts-08

I was thinking that one way for the application to learn the normalized
(by the mechanism) OpenID identifier could be through a name attribute.
I'm not certain this is necessary, and given the complexity and lack of
response on this topic, I have been considering to skip this for the
time being.  This aspect could be revisited in the future, if
applications wants a way to learn the normalized OpenID identifier.

I am also not certain this is an appropriate use of name attributes.

> of the OpenID gssapi mechanism).

Ok.  Several people appears to believe a nametype for OpenID is the
right thing, so I think we should add it.

The name canonicalization rules are specified in the OpenID
specification, however some parts of it requires interaction with the
network, and is thus not trivial for an OpenID-unaware application to
do.  Hence my idea that it should be the OpenID mechanism that performs
the canonicalization and let the application know what the canonical
name is.  Does this make sense?

/Simon