James Tindall | 22 Jul 15:48
Gravatar

[OpenID] choosing endpoint after performing discovery on claimed_id from response

Suppose a relying party is operating under stateless mode. Suppose also 
that the discovery phase for the given claimed_id returned more than one 
endpoint. Then suppose that association attempts failed on at least one 
of the endpoints but then succeeded on one of the other endpoints 
further down the priority order. Then upon receiving the authentication 
(id_res) response from the chosen OP the RP must perform discovery on 
the claimed_id contained in the response in order to be able to verify 
the response data against discovered data. But then if, as is probable, 
the discovery phase again returns more than one endpoint, how is the RP 
to choose which one to verify the response data against?

=james.tindall

Gmane