Re: [ogpx] Context for Service Establishment in OGP

I will be there. 

Christian Scholz <cs@comlounge.net> 
Sent by: ogpx-bounces@ietf.org
06/02/2009 03:22 PM

To
Infinity Linden <infinity@lindenlab.com>
cc
"ogpx@ietf.org" <ogpx@ietf.org>
Subject
Re: [ogpx] Context for Service Establishment in OGP

Hi!

First of all great to see some action again :-)

And who is actually coming to Stockholm?

> i've been talking with John Hurliman about OAuth and David Lavine
> regarding X.509, and at some point it made sense to abstract the three
> different authentication / authorization schemes into a single
> "service establishment pattern." The message I just sent out really
> describes only the mechanism (and only enough mechanism to understand
> the concept.) over the next couple of weeks, i'd like to add some more
> detail to this and integrate it into the OGP : Authentication
> document. So feedback will definitely be welcomed.
> 
> to recap:
> 
> * there are three different types of authentication / authorization:
> password, X.509 and OAuth
> * password auth is appropriate for user -> server authentication
> * X.509 is appropriate for server <-> server authentication, and
> * OAuth is appropriate for server -> distant peer (whom you may not
> have an explicit trust relationship with.)
> * in all cases, you start with an authenticator (a password, a
> certificate or a token) and by presenting it to a server at a well
> defined service establishment URL, you'll get a seed cap back
> * with that seed cap, you can request those specific capabilities you 
require

I personally would prefer it more if OAuth would replace those caps (as 
you probably know). Are there any plans to do more than just the initial 
step? Also what problem we are trying to solve here? What is an example 
use case? I think that would help me to understand the context even more 
:-)

-- Christian

-- 
COM.lounge GmbH
http://comlounge.net
Hanbrucher Strasse 33, 52064 Aachen
Amtsgericht Aachen HRB 15170
Geschäftsführer: Dr. Ben Scheffler, Christian Scholz

email: info@comlounge.net
fon: +49-241-4007300
fax: +49-241-97900850

personal email: cs@comlounge.net
personal blog: http://mrtopf.de/blog
personal podcasts: http://openweb-podcast.de, 
http://datawithoutborders.net

_______________________________________________
ogpx mailing list
ogpx@ietf.org
https://www.ietf.org/mailman/listinfo/ogpx