AOL OpenAuth

Monday, June 18, 2007 [cross post from dev.aol.com]

It's been a while since we spoke about how things are going in the OpenAuth side. So let me get you all up to speed. :-)

We have got very good feedback from several people. We are happy to see people not only using our APIs, but also building open source toolkits & modules. We have updated the Ruby on Rails samplecode on the OpenAuth site (Many thanks to Tony).There is a new Perl module written by Tatsuhiko Miyagawa to use our APIs to authenticate users into perl based web applications. John Panzer proposed a way to incorporate  OpenAuth into Atom Publishing protocol, which I think is being implemented by the AOL Journals team (need to confirm but I am sure John played around with it while he was still working for AOL) and was also implemented by a 3rd party developer as a proof of concept in his application (unfortunately I can't find more details now but will try to find out and update soon).

At the last IIW, Srinivas from my team led discussions around Token Exchange extension to OpenId (George's blog entry) and OpenAuth in general, which led to several discussions around

• how to bridge Web Apps/Sites and Open Services world whenusingOpenId,
• the need to have a simple and open user consent model, and
• how to solve Identity, Authentication and Authorization forsimple Web 2.0 applications all under user's control.
   

We will be implementing our Token Exchange extension proposal as part  of our next phase and publish the document soon.

Coming to what we are working on currently, we have been quite busy implementing OpenID Relying Party (Consumer) support as part of our OpenAuth Servers. The idea is to get the infrastructure updated to support 3rd party Identities at AOL, which I usually call "Simple and Open" Federated accounts. Once this is in place, any one (including AOL properties and 3rd party web apps) using OpenAuth could benefit from opening up their web applications accessible for not just AOL/AIM/ICQ users, but also to all OpenID users (that we can reliably verify) out there.

Also as you might have heard, we now also support the Verisign'sSeatbelt plugin for firefox (IE version is underway) that helps in protecting OpenId user's from phishing attacks. As per the Verisign team, the Seatbelt plugin will be pushed to the FireFox extensions site soon and will be available for anyone to download and install in their Firefox browsers.

Well, we will keep you posted about our progress. Meanwhile, please do send us your feedback and also any new features/functionality that you would like to see supported in our OpenAuth API.

- Praveen


openauth at 8:33:00 PM EDT Blog about this entry |  Add to del.icio.us |  digg this

This entry has 2 comments: (Add your own)

• #2 Comment from alavillipraveen 
  6/19/07 9:46 AM | Permalink

  well as you might already know "trust" between RP and OP is not very well established in the OpenID world. Since anyone in the world can setup and run their own OP (OpenID Provider), we have to be careful with whom we can let login to AOL and whom we don't want to (mainly for the reasons of spamming & spimming). Unfortunately there is no "Reputation Service" yet that we all can use to find out the reputation of an OP. So till then, we might need to probably come up with a white list of OPs, whose users we allow to login to AOL. We will start with a small list of known and obvious OpenID providers and start adding more to it as we receive requests from others.
• #1 Comment from enaelaoni 
  6/19/07 4:03 AM | Permalink

  What do you exactly mean by "that we can reliably verify" about OpenID users.
  Regards.