So it seems there is a little bit of confusion around what needs to be returned from which endpoint among the readers of OpenID Connect specification. It actually is pretty clear if you understand what OAuth 2.0 response_type parameter is, but since it is not spelled out clearly in the OAuth 2.0 spec, people seem […]
When you read the OpenID Connect Specifications, you might feel a little bit intimidated. That’s because they are written in “spec language” and they deal with corner cases, etc. Yet when you translate them into normal English and just concentrate on a “simple case”, it becomes quite simple. So, here we go! (OK, much of the text is the same […]
So, BrowserID is buzzing. In general, browser helping user to secure their login is a good thing. But, I have bunch of problem with the current state of BrowserID. I feel like it has gone back to the era of OpenID 1.0, which had numerous problems. Privacy Advantage? In How BrowserID differs from OpenID, it is […]
In an effort to unify Artifact Binding (AB) and Connect (C), Breno (Google), John (Protiviti), and I did a bit of work at iiw and converged to the following split of the specs. So, the structure of the spec will be as follows. ( [A] and [C] indicates Artifact Binding WG work item and Connect […]
At IIW 2010B, we had a major advancement in the JSON Signature and Encryption Spec. Microsoft, Google, Facebook and me and John Bradley basically converged to a spec. The details has been posted to OpenID Artifact Binding WG list (archive -> http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20101108/date.html ). – JSON Token Spec Results at IIW on Tuesday: – JSON Token […]
On October 28, 2010, hootsuite launched a new capability: hootsuite is now an OpenID RP. (See this announcement: Just Hatched ~ Connect to HootSuite with OpenID Providers ) Well, it is a week old “news” but I just noticed it now when I tried to tweet at IIW, so… You can “click login” to Google, […]
The call for nominations for the 2011 IDDY (IDentity Deployment of the Year) Awards is now open! Kantara Initiative is excited to continue this awards program for the fifth year. We encourage you to refer partners and organizations that could be good candidates for the award program.
Yet another OpenID provider is going under. On Sept. 30 when Six Apart officially shuts down VOX, a blogging site and an OpenID provider. I have been dealing with this issue for many years, and have been blogging, speaking etc. for many years. (e.g., Identity 2.0 and Mydentity, Identity Loss with OpenID 2.0 ). This […]
LoA stands for Level of Assurance. Most popular reference to this idea may be OMB M04-04 and NIST SP800-63. Essentially, it classifies the identities into four categories from Level 1 to Level 4, where Level 4 stands for higher assurance. For internet commerce, generally, Level 2 or so is required. This can be applied to […]
Japanese government went live with OpenID Artifact Binding (AB) draft07. It uses usual OpenID 2.0 to connect to major OpenID providers and uses AB to connect among government agencies. https://openlabs.go.jp/