The OpenID Foundation membership has approved OpenID Provider Authentication Policy Extension 1.0 as an OpenID specification by a vote of forty-two to three, with seven abstentions. This is a significant development for the OpenID community for two reasons: First, this is the first new specification to be developed under the OpenID Foundation’s IPR policies and procedures, which ensure that all are free to use it (like the existing approved specifications) – paving the way for additional specifications to come. Second, the PAPE specification provides an important security enhancement to OpenID Authentication, which can be used with both OpenID 1.1 and OpenID 2.0.
Specifically, the PAPE Specification enables Relying Parties to request that OpenID Providers employ specified authentication policies when authenticating users and for OpenID Providers to inform the Relying Parties which policies were actually used. With PAPE, for instance, a Relying Party can request that the OpenID Provider employ a phishing-resistant authentication method for authenticating the user, and know whether such a method was used or not. The specification can also be used to request multi-factor authentication and to learn what NIST level (or other levels) the authentication conforms to.
At the time of this writing, the working group is aware of at least four implementations of the specification: PHP, Ruby, and Python development versions from OpenID Enabled and a .NET version from the DotNetOpenID project.
The PAPE working group looks forward to seeing use of the specification help make OpenID interactions more secure in the real world!
– Mike Jones, for the PAPE Working Group
Tags: pape, security, specification
December 31st, 2008 at 5:33 am
[...] I just announced on openid.net, OpenID Provider Authentication Policy Extension 1.0 (PAPE) has just been just been approved as an [...]
January 2nd, 2009 at 3:42 am
Excellent news.
January 7th, 2009 at 12:53 am
That realy a good news. I hope Web Site using OpenID will use it to order to improve Security. Like http://buxfer.com/ as an example…
Looks like some SAML attributes. Sounds good
January 7th, 2009 at 9:42 pm
[...] in time before year’s end the Provider Authentication Policy Extension (PAPE) was approved as an OpenID specification by votes of members of the OpenID [...]
January 15th, 2009 at 12:42 pm
Splendid news.
January 15th, 2009 at 8:53 pm
[...] How do I get one? « PAPE Approved as an OpenID Specification [...]
June 18th, 2009 at 7:30 pm
in time before year’s end the Provider Authentication Policy Extension (PAPE) was approved as an OpenID specification by votes of members of the OpenID