<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
I believe, based on quite a few discussions with quite a few people lately, that it's time we finally started thinking about and working on the backend architecture.<BR>
<BR>
I propose we take the same "modularized and malleable" approach that has been so successful on the region side - which would in effect mean, <BR>
<BR>
* an extensible plugin system (Hooking up to events, like in the region)<BR>
* support for several authentication sources (As plug-ins)<BR>
and <BR>
* support for several, co-existing and complementing, client and backend protocols (I've already suggested that we center on a good set of 'handlers' that can be re-used - it seems like a good unifying point.)<BR><BR>
Given that we haven't done much on the servers anyway, I think that this is an golden opportunity.<BR><BR>
By the way, another good thing with the 'handlers' approach is that that would, in theory, let you 'assemble' a server process by just choosing what handlers to register in it, so if you want to separate login from user (which makes big sense from a security standpoint) you could just configure two processes.<BR>
<BR>Best regards,<BR>Stefan Andersson<BR>Tribal Media AB<BR> <BR>> Date: Mon, 15 Dec 2008 17:11:39 -0800<BR>> From: aerowolf@gmail.com<BR>> To: opensim-dev@lists.berlios.de<BR>> Subject: Re: [Opensim-dev] openid (other authentication methods)<BR>> <BR>> Would there be a major problem with allowing an X.509<BR>> client-certificate based authentication system? (No, it won't work<BR>> with the existing Linden client either.)<BR>> <BR>> -Kyle H<BR>> <BR>> On Mon, Dec 15, 2008 at 5:39 AM, James Stallings II<BR>> <james.stallings@gmail.com> wrote:<BR>> > I am not JHurliman, but I have actually given this topic considerable<BR>> > thought. As I see things, there probably is no way to incorporate OpenID<BR>> > directly into the existing client.<BR>> ><BR>> > I dont let this concern me overmuch - I think constraining ourselves to<BR>> > existing client functionality is a certain way to allow our friends at<BR>> > Linden Labs to remain the defacto industry leaders of this technology.<BR>> ><BR>> > Now that that is out of the way, there are certain methodologies that I<BR>> > could employ to put an OpenID capability to work today:<BR>> ><BR>> > Scenario 1: Keep all accounts 'deactivated' by default (even when they are<BR>> > valid, active accounts), activating them only at such time as the OpenID<BR>> > authorization method I've embedded into the splash page is completed. Once<BR>> > that embedded authorization procedure is completed, the account would be<BR>> > enabled, and login would procede as normally occurs with the client.<BR>> ><BR>> > Scenario 2: All login procedures as per usual; OpenID kept on file for for<BR>> > positive identification on an as-needed basis where such things are<BR>> > relevant: access to mature content, proof of ownership of assets, resolution<BR>> > of complaints, etc.<BR>> ><BR>> > Scenario 3: External authentication layers that might be built on top of<BR>> > e.g., Hypergrid or OGP, which cant really be explored at present because we<BR>> > have no support for authenticating via OpenID.<BR>> ><BR>> > These are just three that occur to me off the top of my head. I think all<BR>> > represent use cases that are desirable here and now. We simply lack the<BR>> > tools to implement them at present. All that remains is that some<BR>> > trailblazing group put the tools in the hands of users.<BR>> ><BR>> > Will we blaze that trail? or will we read about who already has on the<BR>> > Linden blog?<BR>> ><BR>> > I say +100, get this patch in trunk. ASAP.<BR>> ><BR>> ><BR>> > Cheers<BR>> > James<BR>> ><BR>> ><BR>> > On Mon, Dec 15, 2008 at 7:03 AM, Sean Dague <sdague@gmail.com> wrote:<BR>> >><BR>> >> Hurliman, John wrote:<BR>> >> ><BR>> >> > A clarification on the patch, this adds OpenID provider support to user<BR>> >> > server. It does not turn the user server into an OpenID consumer. I think<BR>> >> > OpenID grid login is a very interesting discussion that should take place on<BR>> >> > the mailing list, but what this does is allow you to prove ownership of an<BR>> >> > avatar on a grid. You could leave a comment on a blog using your avatar<BR>> >> > identity, for example. The main reason for the patch is to pave the way to<BR>> >> > building a secure hypergrid. Now that OpenSim is evolving into a federated<BR>> >> > grid model it's critical to be able to carry identity around the metaverse.<BR>> >> > I also have a patch for the distributed asset service that authenticates all<BR>> >> > inventory and asset transactions against the user server and allows<BR>> >> > whitelisting/blacklisting of foreign grids (will be committed very soon<BR>> >> > after some cleanup).<BR>> >><BR>> >> Could you explain that authentication flow with the existing client?<BR>> >> While this patch doesn't hurt anything, I'd really like to understand<BR>> >> where this is going before we commit something like this.<BR>> >><BR>> >> -Sean<BR>> >><BR>> >> --<BR>> >> Sean Dague / Neas Bade<BR>> >> sdague@gmail.com<BR>> >> http://dague.net<BR>> >><BR>> >><BR>> >><BR>> >> _______________________________________________<BR>> >> Opensim-dev mailing list<BR>> >> Opensim-dev@lists.berlios.de<BR>> >> https://lists.berlios.de/mailman/listinfo/opensim-dev<BR>> >><BR>> ><BR>> ><BR>> ><BR>> > --<BR>> > ===================================<BR>> > The wind<BR>> > scours the earth for prayers<BR>> > The night obscures them<BR>> ><BR>> > http://osgrid.org<BR>> > http://del.icio.us/SPQR<BR>> > http://twitter.com/jstallings2<BR>> > http://www.linkedin.com/pub/5/770/a49<BR>> ><BR>> > _______________________________________________<BR>> > Opensim-dev mailing list<BR>> > Opensim-dev@lists.berlios.de<BR>> > https://lists.berlios.de/mailman/listinfo/opensim-dev<BR>> ><BR>> ><BR>> _______________________________________________<BR>> Opensim-dev mailing list<BR>> Opensim-dev@lists.berlios.de<BR>> https://lists.berlios.de/mailman/listinfo/opensim-dev<BR><BR></body>
</html>