Re: questions about LRDD / OpenID

[Markus Sabadello <markus.sabadello@xdi.org>]

Hmm thanks. My questions were mainly motivated by thinking what an implementation of all this could look like.

Possibilities:
1. There's a "link discovery" library which can be used by applications (OpenID, oAuth, others)
2. There's a "LRDD" library which can be used by applications (OpenID, oAuth, others)
3. There's a "XRD discovery" library which can be used by applications (OpenID, oAuth, others)
4. There are no libraries at all, and applications (OpenID, oAuth, others) implement whatever discovery they need themselves
5. Other possibilities?

Since so much in link discovery and LRDD is "application specific", it appears difficult to design a reusable library. Will this really promote interoperability?

Markus

On Mon, Mar 23, 2009 at 7:09 PM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:

On 3/23/09 8:44 AM, "Markus Sabadello" <markus.sabadello@xdi.org> wrote:

> 1. When performing LRDD on Joe's OpenID http://example.com/joe, you say that
> in step 3 the relying party gets the /host-meta file and looks for the
> "Link-Pattern" entry. My question is, shouldn't it also look for a "Link"
> entry?

Not when performing LRDD. The /host-meta Link record is currently specified
to apply to all resources under the same authority (wording I plan to
change), but such records are not used in LRDD. The short answer is that
there are many other methods we could have included but decided to limit the
list to three specific methods.

The long answer is how that it creates a complicated flow where it is now
clear which records to use.

OpenID may choose to use /host-meta Link for performing a site-wide
discovery that is not for a specific URI. But that is not part of LRDD.

> 2. In LRDD, if the /host-meta file contains both a suitable "Link" entry and a
> suitable "Link-Pattern" entry, which one takes precedence?

See #1. Only Link-Pattern is used in LRDD.

> 3. It seems that XRD is now very similar to the various Link mechanisms. My
> question is, in your OpenID example, could the same goals be achieved without
> using XRD at all? E.g. when performing LRDD on Joe's OpenID
> http://example.com/joe, instead of discovering an XRD via describedby links,
> couldn't you also directly discover the OpenID provider:

While they are semantically identical, an application using XRD over LRDD
will only look for application records in the XRD and not in other links.
This is mostly for interoperability which is the main reason for all this
work.

Think about it this way, the same way LRDD is making some restrictive
choices about which links to use, applications using XRD are applying the
same pattern by limiting where their application-specific meta is located.

EHL