AOL OpenAuth Update - June 2007

It's been a while since we spoke about how things are going in the OpenAuth side. So let me get you all up to speed. :-)

We have got very good feedback from several people. We are seeing people not only using our APIs, but also building open source toolkits & modules. We have updated the Ruby on Rails sample code on the OpenAuth site ( Many thanks to Tony). There is a new Perl module written by Tatsuhiko Miyagawa to use our APIs to authenticate users into perl based web applications. John Panzer proposed a way to incorporate OpenAuth into Atom Publishing protocol, which I think is being implemented by the AOL Journals team (need to confirm but I am sure John played around with it while he was still working for AOL) and was also implemented by a 3rd party developer as a proof of concept in his application (unfortunately I can't find more details now but will try to find out and update soon).

At the last IIW, Srinivas from my team led discussions around Token Exchange extension to OpenId (George's blog entry) and OpenAuth in general, which led to several discussions around

• how to bridge Web Apps/Sites and Open Services world when using OpenId,
  
• the need to have a simple and open user consent model, and
• how to solve Identity, Authentication and Authorization for simple Web 2.0 applications all under user's control.
  

We will be implementing our Token Exchange extension proposal as part of our next phase and publish the document soon.

Coming to what we are working on currently, we have been quite busy implementing OpenID Relying Party (Consumer) support as part of our OpenAuth Servers. The idea is to get the infrastructure updated to support 3rd party Identities at AOL, which I usually call "Simple and Open" Federated accounts. Once this is in place, any one (including AOL properties and 3rd party web apps) using OpenAuth could benefit from opening up their web applications accessible for not just AOL/AIM/ICQ users, but also to all OpenID users (that we can reliably verify) out there.

Also as you might have heard, we now also support the Verisign's Seatbelt plugin for firefox (IE version is underway) that helps in protecting OpenId user's from phishing attacks. As per the Verisign team, the Seatbelt plugin will be pushed to the FireFox extensions site soon and will be available for anyone to download and install in their FireFox browsers.

Well, we will keep you posted about our progress. Meanwhile, please do send us your feedback and also any new features/functionality that would like to see supported in our OpenAuth API.