[rtcweb] HTTP POST for IdP

Martin Thomson <martin.thomson@gmail.com> Thu, 06 March 2014 09:28 UTC

MIME-Version: 1.0
Date: Thu, 06 Mar 2014 09:28:51 +0000
Message-ID: <CABkgnnWk12BU1ov=aeTQ02tu8h=B2-0crpBmcN7YoPnubD-uJg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: "rtcweb@ietf.org" <rtcweb@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/rtcweb/lTZRwUlzcFF0Qshg7KUAoNyL_c4
Subject: [rtcweb] HTTP POST for IdP
Precedence: list

As discussed in the meeting, I've put together a proposal for handling
IdP interactions using HTTP POST.

This adds a direct translation of the exchanges that are sent over the
Message Channel to JSON over HTTP POST.  This allows servers or
non-browser applications to use the IdP.

More details:
 - the "id" and "origin" parameters are only used for the MessageChannel mapping
   - for "id", HTTP provides adequate request-response correlation
   - for "origin", the HTTP Origin header should suffice
 - there is a new field added to the identity assertion that
identifies the supported interaction models: "proxy", "http" or both,
included in an array
    - on this point, we should discuss in the W3C whether we will add
this parameter to setIdentityProvider
 - there are some structural changes required to make this flow properly
 - I've referenced the new JSON RFC

Actual change request:
https://github.com/ekr/ietf-drafts/pull/14/files

[rtcweb] HTTP POST for IdP Martin Thomson