Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Alice already has a multi-protocol browser add-on (aka selector, smart client, etc.)
  • Alice has already configured the add-on with five OpenIDs: Yahoo, AOL, Google, Facebook, Janrain
  • Alice has no i-cards configured in the add-on
  • Alice wants to login to the NIH site
  • Alice is not logged in to any of her five OpenIDs at the moment
  • The site is a SAML, OpenID, and IMI/InfoCard compatible RP
  • The site trusts Yahoo, AOL, Google, as well as Equifax, Citigroup, Silicon Wave, Acxiom
  • Alice has never been to this site before
  • Alice has not defined a "default" OpenID or SAML or InfoCard

Flow

  1. The user clicks on a "sign in" button on the NIH site
    • The addon reads some data that tells it stuff like:
    • That the site is an RP for OpenID, IMI and SAML protocols (unusually it does not support username/password!)
    • The list of attributes that the site wishes to receive and for each attribute the list of authorities that the RP trusts. In our case the site is going to request only a non-correlateable identifier (aka an IMI "PPID", aka an OpenID "directed" identity) and that it trusts only Yahoo, AOL, Google, as well as Facebook, Equifax, Citigroup, Silicon Wave, Acxiom to issue this attribute
  2. The add-on displays a login window. It consists of a dropdown showing two accounts that could be used immediately (because Alice has these accounts and the NIH site accepts these accounts), as well as one account that Alice could potentially use if she signed up with Google to get one (but she doesn't have one at present):
    • Google
    • Yahoo
    • AOL
  3. Alice clicks on Google
  4. Alice authenticates to Google
  5. Alice agrees to share Google attributes with NIH

...