[rtcweb] HTTP POST for IdP

Martin Thomson <martin.thomson@gmail.com> Thu, 06 March 2014 09:28 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id 13BD21A0178 for <rtcweb@ietfa.amsl.com>; Thu, 6 Mar 2014 01:28:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id 7BWHZjyz2Cmq for <rtcweb@ietfa.amsl.com>; Thu, 6 Mar 2014 01:28:56 -0800 (PST)
Received: from mail-wg0-x22f.google.com (mail-wg0-x22f.google.com [IPv6:2a00:1450:400c:c00::22f]) by ietfa.amsl.com (Postfix) with ESMTP id E86B01A0170 for <rtcweb@ietf.org>; Thu, 6 Mar 2014 01:28:55 -0800 (PST)
Received: by mail-wg0-f47.google.com with SMTP id x12so2774402wgg.6 for <rtcweb@ietf.org>; Thu, 06 Mar 2014 01:28:51 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=erFoflZRfZUcwes4yVcDfytjyBxLqWSEVShjuzKanRA=; b=1AGwQquDBcOtXpyO9+rQWY/5J/p7jSbQffyCQXRGP1WlWm09Hn6DRCZNE1dP7450ZT p7/+NO2mvgAQPVCAqKGi6HGc6uZ0Xdcy90opbTeHwnHs4glqHCM3INsTWfwFxxJQbS1/ 1C9KAPq3ipjqnuJ5hU7bpFpZRCxCnfHS/lr9F4aCrR1drLM2vBKT60/0T2U0aHmDNc+F DoB6m1OPgKROsVSXaDSUlJ4Y6ofPYCC71jHEGbwsN92guxtKLjGQvLDFKxg0OmuiZThG 0Vr2ZOj+K6taZybOzA5S5vg5RMQ/P4dyTRAVAfK9Qy0S5UpKg9WUT/NNfF3uC324erL+ owoQ==
MIME-Version: 1.0
X-Received: by with SMTP id an7mr8216874wjc.39.1394098131693; Thu, 06 Mar 2014 01:28:51 -0800 (PST)
Received: by with HTTP; Thu, 6 Mar 2014 01:28:51 -0800 (PST)
Date: Thu, 06 Mar 2014 09:28:51 +0000
Message-ID: <CABkgnnWk12BU1ov=aeTQ02tu8h=B2-0crpBmcN7YoPnubD-uJg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: "rtcweb@ietf.org" <rtcweb@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/rtcweb/lTZRwUlzcFF0Qshg7KUAoNyL_c4
Subject: [rtcweb] HTTP POST for IdP
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Mar 2014 09:28:58 -0000

As discussed in the meeting, I've put together a proposal for handling
IdP interactions using HTTP POST.

This adds a direct translation of the exchanges that are sent over the
Message Channel to JSON over HTTP POST.  This allows servers or
non-browser applications to use the IdP.

More details:
 - the "id" and "origin" parameters are only used for the MessageChannel mapping
   - for "id", HTTP provides adequate request-response correlation
   - for "origin", the HTTP Origin header should suffice
 - there is a new field added to the identity assertion that
identifies the supported interaction models: "proxy", "http" or both,
included in an array
    - on this point, we should discuss in the W3C whether we will add
this parameter to setIdentityProvider
 - there are some structural changes required to make this flow properly
 - I've referenced the new JSON RFC

Actual change request: