summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJoey Hess <joey@kodama.kitenet.net>2008-02-24 17:31:18 -0500
committerJoey Hess <joey@kodama.kitenet.net>2008-02-24 17:31:18 -0500
commitb045e3124a0bdeeaa187dbe669b3056c6c19ee4a (patch)
treeadaf843e27bfbea7c766797af4ffffd8692acaef
parent4eabb3cb7a1a7c9af3232e8e8713e00a2d5dd861 (diff)
closing with explanation
-rw-r--r--doc/bugs/ssl_certificates_not_checked_with_openid.mdwn16
1 files changed, 16 insertions, 0 deletions
diff --git a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
index 802ab16a7..1d1e62092 100644
--- a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
+++ b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
@@ -7,3 +7,19 @@ Test #2: Download net\_ssl\_test from dodgy source (it uses the same SSL perl li
For now, I want to try and resolve the issues with net\_ssl\_test, and run more tests. However, in the meantime, I thought I would document the issue here.
-- Brian May
+
+> Openid's security model does not rely on the openid consumer (ie,
+> ikiwiki) performing any sanity checking of the openid server. All the
+> security authentication goes on between your web browser and the openid
+> server. This may involve ssl, or not.
+>
+> For example, my openid is "http://joey.kitenet.net/". If I log in with
+> this openid, ikiwiki connects to that http url to determine what openid
+> server it uses, and then redirects my browser to the server
+> (https://www.myopenid.com/server), which validates the user and redirects
+> the browser back to ikiwiki with a flag set indicating that the openid
+> was validated. At no point does ikiwiki need to verify that the https url
+> is good.
+> --[[Joey]]
+
+[[tag done]]