<HTML>
<HEAD>
<TITLE>Web Services Access using YADIS</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>I was talking to Brian Ellin a few weeks back...<BR>
A cool thing to do would be to restrict/allow access to web services using OpenID/YADIS.<BR>
</SPAN></FONT><SPAN STYLE='font-size:12.0px'><FONT FACE="Monaco, Courier New">Basically, user logs into his domain. User want to access web service in another trusted domain. This should be allowed without requiring user to re-login (assuming that domains have a trust relationship).<BR>
User would pass its openid and a one-time (or time-limited) token to Server B. Server B would use token to verify authentication of user by presenting token to originating server. Server B would also get access to profile info (optional but required in my case to get access to permission attributes). Access to web service would then be granted or not based on presented permissions.<BR>
Has anyone done something like this?<BR>
Thanks,<BR>
Pat.<BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"><BR>
</FONT></SPAN>
</BODY>
</HTML>