The OpenID Authentication 2.0
specification states in section 5.2 that "There are two methods for
indirect communication: HTTP redirects and HTML form submission". It is
worth noting that a third method might be added to this list: Qworum (
http://www.qworum.com/
).
Qworum is a fairly new technology (a couple of years old) that aims to
solve precisely the problem of indirect communication between
interactive web services (such as between Relying Parties and OpenID
Providers). Qworum mandates that the caller (i.e. RP) and the callee
(i.e. OP) communicate through XML documents.
Here is one possible authentication scenario involving Qworum:
1. The RP calls the OP by sending the following Qworum message to the
user agent:
<!-- Return to the RP after calling the OP -->
<qrm:goto href='' xmlns:qrm='
http://www.qworum.com/'>
<!-- Call the OP -->
<qrm:call href=''>
<!-- Authentication request message -->
<message xmlns:openid='
http://openid.net/'>
<openid:mode>checkid_setup</openid:mode>
<openid:identity>
http://openid-provider.net/my_id</openid:identity>
...
</message>
</qrm:call>
</qrm:goto>
This message instructs the user agent to call the OP and to send the
result back to the RP.
2. The user agent then calls the OP (i.e.
http://openid-provider.net/my_id
) by POSTing it the following XML document:
<message xmlns:openid='
http://openid.net/'>
<openid:mode>checkid_setup</openid:mode>
<openid:identity>
http://openid-provider.net/my_id</openid:identity>
...
</message>
3. The OP interacts with the end user.
4. The OP sends the following Qworum message to the user agent:
<!-- Authentication response message -->
<message xmlns:openid='
http://openid.net/'>
<openid:mode>id_res</openid:mode>
<openid:identity>
http://openid-provider.net/my_id</openid:identity>
...
</message>
5. Finally, the user agent then POSTs the authentication response
message back to the RP. Note that the RP return address is handled by
the user agent, not the OP.
Adding Qworum as a third communication method would not break existing
methods, it would just offer one more choice to RPs:
* The RP can check whether the user agent has Qworum capability by
inspecting the Accept header of the HTTP request. The RP can then
choose to use Qworum.
* The OP would understand that the RP is using Qworum to call it if the
Content-Type of the HTTP POST request is application/xml.
So my question is this: Has Qworum been considered for indirect
communication, or could it be considered in the future? (As the lead
developer of Qworum, I can affirm that Qworum would do all it can to
facilitate this process.)
--
Doğa Armangil
