Re: [ogpx] Seed capability behavior

["Infinity Linden (Meadhbh Hamrick)" <[e-mail]>]

On Wed, Jan 20, 2010 at 17:03, Hogmanay Milestone
<[e-mail]> wrote:
>>
>>but why would you need a proxy anyway?
>
>
> because the services requested by the proxy may be on the inside of a firewall while the client is on the outside. if the proxy was in the DMZ, you could use traditional network security tools to ensure that service requests only come from a proxy that you trust.
>

so if i understand you correctly, you want the client out there on the
internet to authenticate to an agent domain, get a seed capability
from the agent domain and then pass that seed capability to a proxy in
the DMZ of some organization (say, like the client's employer.)

the proxy would then use that seed cap to request service caps from...
someone? the agent domain? or a server in the client's employer's
intranet (that the proxy can access because it's in the DMZ?)

it's unclear where you're requesting the service caps from.

but i think i understand why you want the seed cap to be a one-shot.
if it wasn't a one-shot, the proxy _could_ retain the ability to
request service caps on the client's behalf.