[Auth]pibxml thoughts

[Mario D. Santana]

Since I haven't gotten any response about a first implementation of
the Auth stuff, I've started looking at the Mozilla plugin specs and
the PIB/SIML proposals. I thought it might be best to start with a
generic PIB-handling library, and maybe a generic SIML-handling lib,
too, before starting on the Mozilla-specific code.

(I'll be submitting a proposal for all this soon. Please let me know
if I should do other "paper work", since I only recently found DotGNU
and am still finding my way around all the procedures and projects.)

I haven't done much more at this point than define a few structs for
the piblib, but while I was doing that I had a couple of thoughts on
the PIBXML document (at http://members.home.net/alberts/PIB.htm) so I
thought I'd share.

The PIB (whether stored locally, remotely, or both) being the central
storage for a user's personal info, it seems like the right place for
applications to store their (perhaps shared) state. For example, if a
Mozilla Auth plugin gets told to use account A and credit card B for
site C, not only should the next Mozilla session remember that, but
also the next IE session, etc.
       
To this end, it might be more useful to organize the various "pieces"
of an identity independently, and express whole Virtual Identities as
combinations of these pieces. These combinations could then be bound
to accounts (i.e., identity consumers) for delivery according to some
SIML. Encountering a new SIML might trigger the selection of an
existing Identity, or the creation of a new one, to associate with the
new account. So, instead of

  <identity1><credit_cards/><addresses/><etc/>
     <account1/><account2/>
  </identity1>
  <identity2>...

there would be
  <address1/> <address2/>
  <creditcard1/> <creditcard1/>
  <etc1/><etc2/>
  <id1 address="address1" cc="creditcard2" etc="etc12"/>
  <id2 .../>
  <account name="Narnes and Boble" action="url" id="id1"/>
  <account name="OneAteHungryFlowers" action="otherurl" id="id2"/>
  ...

A user will probably want to edit the their pib as the need comes up
in different apps. Of course, if apps are going to be writing to the
pib, there'll have to be some extra care taken which should be
probably be mentioned in the spec.

Err... something. Obviously I haven't thought this through completely.
Hopefully someone'll pipe up and help me out. =)

mds