Commentary by Mark Wahl, CISA
Organizing principles for identity systems:
Henry Story on FOAF and OpenID (20070720)
Last week Henry Story of Sun wrote in his blog on "The limitations of JSON" on the difference between syntax and semantics
"[From a JSON example of a person record] we know there is a map between something related to the string "firstName" and something related to the string "John"... But what exactly is this saying? That there is a mapping from the string firstName to the string John? And what is that to tell us? What if I find somewhere on the web another string "prenom" written by a French person. How could I say that the "firstName" string refers to the same thing the "prenom" name refers to? This does not fall out nicely."
and then gives a FOAF example of the same data, expressed in RDF.
"The RDF version has the following advantages:
- you can know what any of the terms mean by clicking on them (append the prefix to the name) and do an HTTP GET
- you can make statements of equality between relations and things, such as
foaf:firstname = frenchfoaf:prenom .
- you can infer things from the above, such as that
<http://eg.com/joe#p> a foaf:Agent .
- you can mix vocabularies from different namespaces as above, just as in Java you can mix classes developed by different organisations. There does not even seem to be the notion of a namespace in JSON, so how would you reuse the work of others?
- you can split the data about something in pieces. So you can put your information about <http://eg.com/joe#p> at the "http://eg.com/joe" URL, in a RESTful way, and other people can talk about him by using that URL. I could for example add the following to my foaf file:
<http://bblfish.net/people/henry/card#me> foaf:knows <http://eg.com/joe#p> .
You can't do that in a standard way in JSON because it does not have a URI as a base type (weird for a language that wants to be a web language, to miss the core element of the web, and yet put so much energy into all these other features such as booleans and numbers!)
Now that does not mean JSON can't be made to work this way, as the SPARQL JSON result set serialisation does. But it does not do the right thing by default. A bit like languages before Java that did not have unicode support by default. The few who were aware of the problems would do the right things, all the rest would just discover the reality of their mistakes by painful experience. "
Earlier today, he posted on "foaf and openid" that
"My openid http://openid.sun.com/bblfish should not just return a representation that contains a link to the openid server
<link rel="openid.server" href="https://openid.sun.com/openid/service" />
but also a link to a representation that contains more information about me, which would be my foaf file. This could be done very simply by growing the header of my openid html by one line:
<link rel="openid.server" href="https://openid.sun.com/openid/service" />
<link rel="meta" type="application/rdf+xml" title="FOAF" href="http://bblfish.net/people/henry/card"/>
which is what videntity.org has been doing since 2005 ... and openid.org has been providing since early July ... Now all that would be needed then is for dzone to read the foaf file pointed to, and extract the name relation, email and logo from the person described in the foaf file with the same openid. This could be done with a simple SPARQL query such as"
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
SELECT ?mbox ?logo ?nick
WHERE {
?p foaf:openid <http://openid.sun.com/bblfish>.
OPTIONAL { ?p foaf:mbox ?mbox } .
OPTIONAL { ?p foaf:logo ?logo } .
OPTIONAL { ?p foaf:nick ?nick } .
}
and
"For those who are still trying to keep their info private, one could add some content negotiation mechansim to the serving of the foaf file, such that depending on the authentication level of the requestor (dzone in this case), the server would return more or less information. If dzone could somehow show on requesting my foaf file, that I had authenticated them, and that should not be difficult to do, since I just gave them some credentials, I could give them more information about me. How much information exactly could be decided in the same box that pops up when I have to enter the password for the service... A few extra checkboxes on that form could ask me if I want to allow full, partial or minimal view of my foaf relations. Power users with more time on their hands could even decide on a relation by relation basis."
Other resources include
- the FOAF project article "Getting your foaf file noticed"
- the phpbb.cc blog post "OpenID + FOAF + TrackBack = ?"
- from the foaf-dev mailing list, "proposal for foaf:openid property"