is OpenID Connect on the roadmap?

[Cantor, Scott]

On 11/1/12 12:31 PM, "Michael Schwartz" <mike at gluu.org> wrote:
>
>1) Large IDPs now realize they are not alone. Even if you are Google, you
>realize your customers may prefer a Microsoft or Yahoo account for
>authentication.

So Google allows outside identities into their services *other than* for
app domain customers? I'll be surprised if true, but agree that it's a
good sign.

>The OpenID Connect discovery mechanism is based on DNS
>domain names, using a "webfinger-like" mechanism ("SWD - Simple Web
>Discovery"). If you are "cantor.2 at osu.edu" I would query "osu.edu" to
>figure out how to validate a token or send you for authentication. That's
>not a bad solution, and its pretty fair to any kind of organization--not
>just the big IDPs (DOWN WITH FACEBOOK!!!... oops , did I say that
>online... nevermind...)

You're talking specs. I'm talking about what people actually implement and
will deploy. I say that with some confidence having seen the disconnect
between SAML as a spec and SAML software.

>2) Regarding all things assertions, XML, and signing... listen to Scott!
>But the core message was that we are one relatively mature IETF RFC away
>from OpenID Connect going final.

That's fine. That doesn't change anything about the state of the project
or the code base, which are simply constraints that don't have a solution
other than time. And having said that, I have no idea how anybody would
suppose that two completely different code bases could ever end up
combining in any sane way.

>3) Eve Maler had a slightly different assessment of Eran's decision to
>leave. I don't think its black and white:

I don't presume to speak to why he said what he said or anything about his
stated technical objections other than that I agreed with them and that he
was articulating things I had felt for a while about the direction of the
work based on the time I spent on SAML and Liberty.

-- Scott