Subject: [ogpx] OpenID and OGP : beginning the discussion ...

From: Infinity Linden <[email-masked]>
Date: Fri, 26 Jun 2009 11:23:47 -0700

hey peeps.

so a couple years ago there were some preliminary discussions about
integrating OpenID and Second Life(tm). by all accounts, they sorta
went no where. now that a OGP is being defined in terms of LLSD/LLIDL
messages being transported over HTTP (though again... OGP _can_ go
over other transports, we're just starting with HTTP since the
toolchain surrounding HTTP is well developed.) but now that well
defined HTTP messages are a part of OGP, maybe it's time to start
talking about OpenID and virtual worlds again.

so.. there are a couple "issues" with OpenID and desktop applications.
most notably that OpenID concludes it's authentication dance with a
re-direct. as there are limited ways to redirect to a desktop
application (and yes, you could have your application expose a HTTP
service on the local interface to redirect to, but the security
ramifications make it sub-optimal and it's at least as much of a hack
as what we're proposing here.) but as there are limited ways to
redirect to a desktop application, we're proposing that agent domains
that accept OpenID authentication accept a redirect to a service that
responds with a LLIDL/LLSD resource which includes context for
launching the client application. you could apply a unique MIME type
to the message and register the client application as a helper app for
that mime type to ensure the client receives the message from the web
browser.

included in the "launch request message" would be the login URI of the
grid you wish to attach to and info about the agent or account you
want to use to login. since it's an LLIDL/LLSD message, you can add
data fields to the message that might be understandable by one agent
domain, but not another (specifically... if you wanted to tell the
client application to use a different asset server than the default
one for a particular agent domain...)

all the good parts in this draft come from John Hurliman, so thank him
if you like it. if you don't like it, feel free to blame me.

also.. just a note... there's some serious soul searching about
whether the processing expectations section needs to be in a different
draft from the message format definition, or even if all of this needs
to go into the ogp:auth draft and the processing expectations stuff
listed as an option. remember... this is a draft.. it's not set in
stone yet, so if you have ideas about the format or content, please
feel free to bring them up!

-cheers
-meadhbh

---

From: Carlo Wood <[email-masked]>
Date: Sat, 27 Jun 2009 12:33:02 +0200

>    & identifier = {
>      type: 'account',
>      account_name: string,
>      first_name: string,
>      last_name: string,
>    }
>    & identifier = {
>        type: 'agent',
>        first_name: string,
>        last_name: string,
>    }

This seems to implicate that first_name + last_name
have to be unique not only per grid, but globally
for every virtual world.

Is that true? Or would it be possible to use a different
name on different grids? Would it be possible that different
unrelated people use the same name on different grids?

-- 
Carlo Wood <[email-masked]>

---

From: Infinity Linden <[email-masked]>
Date: Sat, 27 Jun 2009 15:54:08 -0700

why would this imply global uniqueness? it describes a message sent
from a client to a particular protocol endpoint.

---

From: Carlo Wood <[email-masked]>
Date: Sun, 28 Jun 2009 14:34:38 +0200

I'm glad it doesn't imply that then :p

Nevertheless, it worries me a bit. At some point we want to be able to 
teleport between grids right? Surely the people will want to have the
same name (and shape) after they teleported in most cases.

If the same first_name+last_name is only unique per grid, then
people will (have to) start fights about names: one has to register
the same first_name+last_name on every grid you want to use.

The make a long story short: they same wars and trouble will immerse
as are happening on IRC now: too many people in a too small namespace.

At some point there will come the strong demand for a "nick serv",
some central point where people can reserve their name for every
large grid on the planet and claim for themselves (for example, to
stop forms of impersonations). That would be 'hack'.

I think we have to seriously think about this. Perhaps there is a
better solution than 'first name / last name' to login ;).