On August 9, the Information-technology Promotion Agency, Japan (IPA) released a draft of a textbook titled “Identity Management Technology Guide” [1]. The 8 edition is still a draft and is apparently intended as a starting point that will be revised extensively in response to feedback from various quarters. It is a tremendous piece of work, and the final version is eagerly awaited.
I have already sent back various comments, but Table 5.2-1, which compares SAML and OpenID, is clearly incorrect, so I would like to point that out here before the table takes on a life of its own.
The table in question is shown below.
Please look at the OpenID column in this table. I will point out the errors one by one below.
Error 1: “With a single digital identity”
A digital identity is defined as a set of attributes. In OpenID 2.0, the attributes provided can be varied for each target site, based on the user’s consent. In addition, the identifier sent at that time is, in principle, what is known as a PPID (Pairwise Pseudonymous Identifier), meaning that a different identifier is used for each site. This statement is therefore incorrect.
Error 2: “Trust relationships between providers are established on a limited, per-transaction basis”
Once a trust relationship has been established, it remains valid unless one of the parties discards it. Therefore, “per-transaction” is incorrect. The accurate description would be that it is established dynamically when the parties connect for the first time.
Error 3: “There are challenges in protecting privacy”
It is entirely unclear what the purported privacy challenges are. Unlike many SAML implementations, which do not seek the user’s consent, OpenID 2.0 in principle requires the user’s permission before attributes are provided (SHOULD). Accordingly, the great majority of actual implementations are designed that way.
The use of PPIDs for identifiers is also recommended, so there should be no problem in this respect either.
Error 4: “The user’s identifier is the URL of a web page owned by the user”
The user identifier received by the site is a non-reassigned identifier (a string) allocated by the IdP; it is not the URL of a web page owned by the user (and does not even need to be a URL).
As shown above, almost every statement is incorrect.
The descriptions in this table are actually about OpenID 1.1
In fact, the descriptions in Table 5.2-1 are correct for OpenID 1.1, which is hardly used. It appears that material written about OpenID 1.1 was taken from somewhere. However, this book’s explanation of OpenID concerns OpenID 2.0. Therefore, the table should also describe OpenID 2.0. I understand that this is scheduled to be corrected in the book’s next draft, but readers of the 8 edition should take note of the points above.
[1] “Identity Management Technology Guide”
Related posts
I Delivered the Opening Address at National Australia Bank’s Roundtable
At noon Japan time on March 26, I delivered the opening address at National Australia Bank's Corporate Digital ID Roundtable. National Australia Bank, commonly known as…
On May 19, I Will Deliver a Keynote at EIC 2026 in Berlin, Titled “When Software Becomes Staff: Governance, Security & Safety for Agentic AI”
On the first day of EIC 2026, I will deliver the keynote “When Software Becomes Staff: Governance, Security & Safety for Agentic AI.”
I Will Appear on the Okinawa Open Days Panel “Current and Future OSS Initiatives in Economic Security”
It is already the day of the event—in fact, I am writing this now (12/4 9:45) at my desk while preparing for the panel—but I will…
You must be logged in to post a comment.