[ogpx] Context for Service Establishment in OGP

[Infinity Linden <[e-mail]>]

whoops... that last message went out without context...

i've been talking with John Hurliman about OAuth and David Lavine
regarding X.509, and at some point it made sense to abstract the three
different authentication / authorization schemes into a single
"service establishment pattern." The message I just sent out really
describes only the mechanism (and only enough mechanism to understand
the concept.) over the next couple of weeks, i'd like to add some more
detail to this and integrate it into the OGP : Authentication
document. So feedback will definitely be welcomed.

to recap:

* there are three different types of authentication / authorization:
password, X.509 and OAuth
* password auth is appropriate for user -> server authentication
* X.509 is appropriate for server <-> server authentication, and
* OAuth is appropriate for server -> distant peer (whom you may not
have an explicit trust relationship with.)
* in all cases, you start with an authenticator (a password, a
certificate or a token) and by presenting it to a server at a well
defined service establishment URL, you'll get a seed cap back
* with that seed cap, you can request those specific capabilities you require

more details and examples forthcoming.

-cheers
-meadhbh