Re: [mmox] where is identity @ in all this?

mmm... the mechanism for authentication _is_ defined in OGP in an  
unambiguous way. the mechanism does not directly support OpenID,  
Kerberos, sxip, shibboleth, etc. (though it's possible to hijack the  
shared secret auth scheme to do OpenID.)

but yes. OGP/Auth as it is currently written defines MECHANISM, not  
POLICY. For instance, the OGP support in the beta grid does not  
support the PKCS12 auth scheme. This was a POLICY decision. If it did,  
it would support it in a way that was verifiably consistent with the  
OGP/Auth spec.

it might be useful to think of OGP as a "bag of tools" for doing  
things like authenticating yourself, placing yourself into a  
particular simulation context, moving around, sending group messages,  
establishing voice channels, etc. it does not stipulate that each  
compliant virtual world implement each and every technique. however..  
before you could hope to have interoperability, you would have to  
publish an "interoperability profile" which defines each of the  
features a particular world implements.

there are examples of such critters... X.509/PKIX, X11, RTP and even  
HTTP to a limited degree. as to the benefit of a protocol that  
provides mechanism and not policy? defining the wire protocol allows  
us to ask our friendly neighborhood open source development team to  
build a "toolbox" for virtual world interactivity. this would allow  
people building virtual worlds to confine their work to the higher- 
margin creative work that tends to "sell" such environments.

-cheers
-meadhbh

On Feb 20, 2009, at 4:38 PM, Lawson English wrote:

> Gareth Nelson wrote:
>>> Tightly coupling the MSP and identity provider functions is why I  
>>> have to
>>> keep telling people that Mark McCahill is named Mysterio Sinister  
>>> in Second
>>> Life - I can't easily be mccahill@duke.edu because Second Life  
>>> doesn't use
>>> external federated identity providers. Then when I go to one of  
>>> the OpenSim
>>> worlds, I need to create another account, and hope that nobody has  
>>> signed up
>>> for Mysterio Sinister before I got there.
>>>
>>
>> Correct me if i'm wrong, but isn't this the problem the OGP agent
>> domain was designed to resolve?
>> I propose an agent domain which itself allows multiple methods of  
>> authentication
>>
>
> Authentication itself was left pretty much under-defined to this  
> point in that OGP, with the assumption that different agent domains  
> might have different authentication schemes. Another thing to keep  
> in mind is that, regarding IP issues, different girds/worlds might  
> have different standards for what is an acceptable authentication  
> scheme.
>
>
> L
> _______________________________________________
> mmox mailing list
> mmox@ietf.org
> https://www.ietf.org/mailman/listinfo/mmox