134 VIEWS
Pinterest LinkedIn LINE

I finally started working on Artifact Binding 1.0 draft 04 last night.
I wrote from 22:00-02:00, took a nap until 03:30, and then drove from Kita-Karuizawa to Tokyo (03:50-07:20). After breakfast and a bath, I continued adding to it until 10:00. For now, I pushed it to Bitbucket and emailed openid-specs-ab. I talked with Breno. To align with OAuth2.0, responses are now standardized on JSON. (As a result, Key-Value Form Encoding is gone.) After that, I talked with John. We discussed the issue of padding in Magic Signature.

Incidentally, the latest HTML copy of the current draft is here. The official repository is http://bitbucket.org/openid/ab/ .

Key points of draft 04

  • Changed the overall structure to make it easier to read.
  • Requests are standardized on URL Encoding / HTTP Form Encoding, and responses on JSON.
  • Defined a variable called openid.response that contains base64url-encoded JSON for responses during Browser Redirect.

For a case without signatures that uses a Request Parameter File (Profile 1), it looks possible to write it from scratch in 1 day. For the RP in particular, it seems it could be as simple as placing a file and pasting a Javascript script onto the page.

On the other hand, if you want to make it secure, you can go all the way to HoK.

Related posts