What do OpenID, Higgins, I-Names, and XDI Have in Common? An OASIS Webinar on XRI and XRDS May 6, 2008 Gabe Wachob, XRI TC Co-Chair Paul Trevithick, The Higgins Project Drummond Reed, XRI TC Co-Chair John Bradley, ooTao, OpenID Les Chasen, NeuStar XRI GRS Markus Sabadello, XDI.org

What do OpenID, Higgins, i-names, and XDI have in common? They all use two new OASIS technologies you may not even have heard of yet. How did these specifications already become key building blocks of the Internet identity layer? What problems do they solve? Where do they fit with the work of other OASIS Technical Committees? That’s what we’ll cover today...

OASIS XRI Technical Committee Formed January 2003

XRI (Extensible Resource Identifier) n A new type of Internet identifier (URI) designed expressly for digital identity n An open standard for abstract structured identifiers l Abstract, i.e., identifiers upon which discovery can be performed l Structured, i.e., a syntactic framework for expressing identifiers – “XML for identifiers”

XRDS (Extensible Resource Descriptor Sequence) n A simple, extensible service discovery format for XRIs or URLs n The logical equivalent of a DNS resource record at the XRI layer of identification n The discovery format used by OpenID 2.0, OAuth, and Higgins

Local Path/Query IP Address Domain Name URI/IRI Abstract Identifier Layer Reassignable XRI “i-names” Persistent XRI “i-numbers” XRDS Docu- ment XRDS Resolution TN (Tele- phone Number) Other concrete identifier types Concrete Identifier Layer Synonyms

Examples of XRI i-names n Human-friendly reassignable identifiers =gmw +flower $xml

Examples of XRI i-numbers n Persistent identifiers (never reassigned) =!7a42.cd93.40f4.18e5 +!3792 +!3792!14

Examples of XRI cross-references n Identifiers reused across +flower*(

Examples of XRIs transformed into URIs n XRI Syntax 2.0 defines a strict trans- formation of an XRI into an IRI and URI xri://=drummond.reed xri://=%E7%94%A8%E4%BE%8B

*example T09:30:10Z xri://= xri://=example.name xri://=!7c4.58ff.7c9a.e285 xri://$res*auth*($v*2.0) openid Query and synonyms Service #1 Service #2 Example XRDS document

The XRI 2.0 specifications n XRI Syntax 2.0 l Explicit syntax for reassignable and persistent identifiers l Global context symbols l Cross-references for identifier reuse across contexts l Flexible delegation at all levels of hierarchy l Lossless transformation into IRI and URI forms n XRI Resolution 2.0 l HTTP(S)-based resolution protocol l XRDS: simple XML discovery document format l Synonym management and verification l Service endpoint selection logic l Redirect and Ref processing

Why have XRI and XRDS already become key building blocks of the Internet identity layer?

Not only have XRI and XRDS become an integral part of OpenID 2.0, but the XRI technical community is now a strong part of the OpenID community. — Bill Washburn Executive Director, OpenID Foundation

XRI and XRDS have become essential elements of the Higgins Project. Without them, we couldn’t fully implement the abstract data model that is the heart of Higgins and the key to user-controlled identity and data sharing. — Paul Trevithick Higgins Project Lead

Where are XRI and XRDS being used today? n OpenID 2.0 n OAuth Discovery n Higgins Project n XDI.org i-name/i-number registries n XDI data sharing

Case Study: the top 3 problems XRI/XRDS solved for OpenID 2.0 n Extensible service discovery n OpenID recycling n Automatic secure resolution

What is OpenID? n An open community specification for user-centric Internet authentication l Based on the concept that users can have their own globally-resolvable identifiers and OpenID authentication providers n Primary use case: eliminate the need for different usernames and passwords at every website

Relying Party (RP) User Discovery OpenID Provider (OP) XRDS Document =drummond.reed

Problem #1: Extensible service discovery n OpenID 2.0 need to describe what versions an OpenID identifier supports n Also what OpenID extensions it supports (SREG, AX, PAPE, etc.) n And what other services may be available (e.g., OAuth, SAML, XDI) n And it needed redundant, prioritized OpenID provider endpoint URLs

Solution: XRDS documents n Simple, standard discovery format n Can be hosted on any blog, web server, IdM system, etc. n Easily extensible using new URIs or XRIs to define service types n Can be extended with elements from any other namespace

*example T09:30:10Z xri://= xri://=!7c4.58ff.7c9a.e285 xri://$res*auth*($v*2.0) 7c4.58ff.7c9a.e285/ +openid

Problem #2: OpenID recycling n With usernames/passwords, usernames can be recycled l The service provider controls the binding with the credential n With OpenID, that’s no longer true l The user controls the binding to the credential! l Losing control of the identifier = losing control of the credential

Solution: persistent synonyms n Bind a recyclable OpenID identifier with a non-recyclable (persistent) identifier, e.g., an XRI i-number n Always authenticate based on the persistent i-number n Treat the recyclable identifier as only a temporary handle for the i-number n The user always stays protected

*example T09:30:10Z xri://= xri://=!7c4.58ff.7c9a.e285 xri://$res*auth*($v*2.0) openid

Problem #3: Automatic secure resolution n OpenID could not specify HTTPS resolution for all OpenID URLs l Too many users do not have access to HTTPS certs or infrastructure l Thus the default had to be HTTP l This forces users with HTTPS URLs to type the entire string, e.g.,

Solution: XRI secure resolution n As abstract identifiers, XRIs always map to concrete identifiers n This mapping process - XRI resolution - offers three trusted modes: l HTTPS, SAML, or both n So XRI i-names used as OpenIDs can use HTTPS resolution as the default l No need for users to know/do anything

XRI and XRDS are also building blocks for other identity solutions n OAuth l XRDS discovery format n Higgins Project l Context discovery and resolution n XDI.org XRI registries l i-name/i-number registries & resolution n SAML and Information Cards l Privacy-protected identifier claims

What is the relationship of XRI and XRDS with other OASIS TCs and the IDtrust Member Section?

XDI (XRI Data Interchange) n The XDI controlled data sharing protocol is based entirely on XRIs l A globally addressable RDF graph where the address of every node is an RDF statement structured as an XRI subject-xri / predicate-xri / object-xri l Enables a simple portable authorization format called XDI link contracts

ORMS (Open Reputation Management Services) n Newest TC in the OASIS IDtrust member section n Will define neutral, vendor-independent specs for exchanging reputation data n XRI and XDI TC members participating l XRI for durable subject identifiers l XDI for controlled data sharing

PKI-Related TCs n Digital Signature Services eXtended (DSS-X) Advancing new profiles for the DSS OASIS Standard n Enterprise Key Management Infrastructure (EKMI) Defining symmetric key management protocols n Public Key Infrastructure (PKI) Adoption Advancing the use of digital certificates as a foundation for managing access to network resources and conducting electronic transactions

Conclusion n Abstract structured identifiers offer 3 key features for the Internet identity layer l Simple, safe, strong identifiers l Simple, extensible, secure service discovery l Interoperability between multiple identity protocols and frameworks n XRI and XRDS are building blocks everyone can use

Contact us n Gabe Wachob, XRI TC Co-Chair l l n Drummond Reed, XRI TC Co-Chair l l n Wikipedia l l

n Learn through the IDtrust Knowledgebase of educational materials and background on the standards n Share news, events, presentations, white papers, product listings, opinions, questions, and recommendations through postings, blogs, forums, and directories. n Collaborate with others online through a wiki interface

Q&A

What is the relationship of XRI to URNs? n Uniform Resource Names are specified by IETF RFC 2141 n They are persistent (non-recyclable) identifiers n XRI combines both URNs and HFNs (human-friendly names) in one syntax and resolution protocol

What is the relationship of XRI to the Handle System? n Handle is a persistent object identifier system developed by CNRI n Specified in RFCs 3650, 3651, 3652 n Handle does not include HFNs or other structured identifier features of XRI n Handle does not use XML or HTTP for resolution

Does XRI introduce new Internet namespaces? n Yes. Although it can describe and reuse many types of existing identifiers, it also includes four formal namespaces at the XRI level of identification = for personal for organizational identifiers + for generic tags $ for specific tags

Does the XRI TC specify public registry services? n No, the scope of the XRI TC is limited to the technical specifications for XRI and specified XRIs (the $ space) n XDI.org, a member of the XRI TC, offers public XRI registry services n XDI.org is a completely separate non- profit organization

What IPR applies to XRI and XRDS? n The TC operates under the OASIS “RF on Limited Terms” mode (standard royalty-free terms) n This has been mandatory from the TC’s original charter n XDI.org made the initial contribution of IPR for what was then called XNS when the TC was formed in 2003

How does Higgins use XRI and XRDS? n Higgins uses an abstract data model to access data in different contexts (distributed repositories) n XRI is used for addressing contexts and entities within contexts n XRDS is used to resolve the metadata a Higgins component needs to open a Higgins context

What open source implementions of XRI and XRDS are available? n OpenXRI (Java) l n Barx (Ruby) l n MyXDI (C++) l