[ogpx] OpenID and OGP : beginning the discussion ...

[Infinity Linden <[e-mail]>]

hey peeps.

so a couple years ago there were some preliminary discussions about
integrating OpenID and Second Life(tm). by all accounts, they sorta
went no where. now that a OGP is being defined in terms of LLSD/LLIDL
messages being transported over HTTP (though again... OGP _can_ go
over other transports, we're just starting with HTTP since the
toolchain surrounding HTTP is well developed.) but now that well
defined HTTP messages are a part of OGP, maybe it's time to start
talking about OpenID and virtual worlds again.

so.. there are a couple "issues" with OpenID and desktop applications.
most notably that OpenID concludes it's authentication dance with a
re-direct. as there are limited ways to redirect to a desktop
application (and yes, you could have your application expose a HTTP
service on the local interface to redirect to, but the security
ramifications make it sub-optimal and it's at least as much of a hack
as what we're proposing here.) but as there are limited ways to
redirect to a desktop application, we're proposing that agent domains
that accept OpenID authentication accept a redirect to a service that
responds with a LLIDL/LLSD resource which includes context for
launching the client application. you could apply a unique MIME type
to the message and register the client application as a helper app for
that mime type to ensure the client receives the message from the web
browser.

included in the "launch request message" would be the login URI of the
grid you wish to attach to and info about the agent or account you
want to use to login. since it's an LLIDL/LLSD message, you can add
data fields to the message that might be understandable by one agent
domain, but not another (specifically... if you wanted to tell the
client application to use a different asset server than the default
one for a particular agent domain...)

all the good parts in this draft come from John Hurliman, so thank him
if you like it. if you don't like it, feel free to blame me.

also.. just a note... there's some serious soul searching about
whether the processing expectations section needs to be in a different
draft from the message format definition, or even if all of this needs
to go into the ogp:auth draft and the processing expectations stuff
listed as an option. remember... this is a draft.. it's not set in
stone yet, so if you have ideas about the format or content, please
feel free to bring them up!

-cheers
-meadhbh