Re: [httpapi] Link relationship types for authentication

[Erik Wilde <[e-mail]>]

hello.

On 2021-01-26 23:11, Evert Pot wrote:
> On 2021-01-26 4:24 p.m., Graham Cox wrote:
>> Apologies if this has already been covered, but have you looked into 
>> the overlap between this and OpenID Connect? I'm far from an expert, 
>> but it seems that some - though not all - of the relations defined 
>> here correspond well with the actions that OIDC offer, though 
>> obviously they work in notably different ways. (The /authenticated-as/ 
>> relation doesn't have any direct mapping in OIDC that I can think of, 
>> but they others all map on to *something*)
> I'm somewhat aware of the specifications and general plumbing. The link 
> relations I'm hoping to register are extremely general though, and don't 
> impose any sort of protocols or media types.

ideally, that's the case for *all* registered link relation types. it's 
not what happens in practice, but good design would imply that link 
relation types are agnostic of implementation details, and these details 
then are established by using link relation types in a specific context, 
such as a protocol that has certain media types for passing messages around.

> For example, a browser extension might find a a link with rel="logout", 
> and render a logout button in a toolbar. It would be good to know if 
> this is fundamentally incompatible with protocols like OpenID Connect, 
> but I'm also not the person to say anything about this with confidence.

if OIDC doesn't have the model of generally applicable link relation 
types, then another possible way forward would be to change that and 
make the OIDC link relation types reusable (and register them), but that 
of course depends on the details of OIDC and how interested that 
community is to create reusable building blocks as part of their spec.

cheers,

dret.

-- 
erik wilde | mailto:[e-mail] |
            | http://dret.net/netdret    |
            | http://twitter.com/dret    |