I finally started working on Artifact Binding 1.0 draft 04 last night.
I wrote from 22:00-02:00, took a nap until 03:30, and then drove from Kita-Karuizawa to Tokyo (03:50-07:20). After breakfast and a bath, I continued adding to it until 10:00. For now, I pushed it to Bitbucket and emailed openid-specs-ab. I talked with Breno. To align with OAuth2.0, responses are now standardized on JSON. (As a result, Key-Value Form Encoding is gone.) After that, I talked with John. We discussed the issue of padding in Magic Signature.
Incidentally, the latest HTML copy of the current draft is here. The official repository is http://bitbucket.org/openid/ab/ .
Key points of draft 04
- Changed the overall structure to make it easier to read.
- Requests are standardized on URL Encoding / HTTP Form Encoding, and responses on JSON.
- Defined a variable called openid.response that contains base64url-encoded JSON for responses during Browser Redirect.
For a case without signatures that uses a Request Parameter File (Profile 1), it looks possible to write it from scratch in 1 day. For the RP in particular, it seems it could be as simple as placing a file and pasting a Javascript script onto the page.
On the other hand, if you want to make it secure, you can go all the way to HoK.
Related posts
[PHP] How to Use openssl_pkcs7_sign
Standardization of JSON Web Signature (JWS) Has Begun at the IETF
Standardization of JSON Web Signature, a standard for attaching signatures to JSON, has begun in the IETF JOSE Working Group[1]. The initial draft is: http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-00 My…
OpenID vs. OAuth
It is often said that OpenID is for authentication and OAuth is for authorization. This was originally something that people involved with OAuth in the United…