Repository navigation
server should provide logged-in WebID and its label(s) to user #897
Description
Originally posted by @TallTed in #869
This does not appear to show the user their logged in WebID, nor any label associated with that WebID. I submit that both of these must be available -- not least because I may have the same label on multiple WebIDs, but only want to associate one WebID with some activity or data.
Activity
dmitrizagidulin commentedon Nov 2, 2018
Can you explain more about the labels? (Their use with WebIDs is not something we currently do.)
What are you using them for, what's the format, etc?
TallTed commentedon Nov 2, 2018
A WebID URI is typically horribly user unfriendly, as has been discussed a lot in regards to typing that string into login boxes.
Alice Jonesshould not see, for instance,https://blah.example.com/stuff/things/people/userid/alicejones#thisas the logged-in-user -- they should seeAlice Jones(which should be anchored with the URI, as here).It may be desirable to also have this display include the IdP's label, as
or even
(where the IdP is separately anchored).
Mitzi-Laszlo commentedon Nov 13, 2018
More on this conversation can be found here https://forum.solidproject.org/t/server-should-provide-logged-in-webid-and-its-label-s-to-user/546
TallTed commentedon Nov 14, 2018
@Mitzi-Laszlo - Why is this issue (which I opened at @kjetilk's request) being closed without PR nor any additional conversation here nor in the new discourse page, which appears to me to do nothing but echo the brief exchange above....
Mitzi-Laszlo commentedon Nov 14, 2018
Hi @TallTed, During the inrupt meeting we spoke about wanting to move some of the discussions from GitHub to forum.solidproject.org as it is a good place for conversations. Apologies for not explaining this in detail and not creating a pull request, we realise we went a bit fast and need to involve the community in the Solid decision. Shall I close the thread on Discourse? Happy to reopen this issue here too.
TallTed commentedon Nov 14, 2018
@Mitzi-Laszlo -- Discussion may sometimes be better in the Discourse forum, and I don't feel strongly about where the discussion should happen on this issue. But I don't think opened issues should be closed until the relevant discussion is had, wherever that takes place, and the issue's closure should include reference to that discussion's conclusion, if it took place elsewhere.
That said, I don't think there's very much to discuss on this...
Once authenticated, that status should be displayed to the user, including both a clearly-visible human-friendly-label (e.g., foaf:name or similar -- depending on what's found via their WebID) and a less-visible or invisible machine-friendly-link (i.e., their WebID URI). Optimally there should also be an indicator of (and link to) the IdP that has authenticated them with that WebID.
Is there a reasoned argument against such display and link?
TallTed commentedon Jun 21, 2019
This is now inappropriately assigned, so will get no appropriate attention. @kjetilk @dmitrizagidulin @luis-aguilar-jd
Ryuno-Ki commentedon Jun 21, 2019
Okay, given that there are lots of false assumptions about names - what would happen if two people have the same name?
TallTed commentedon Jun 21, 2019
@Ryuno-Ki -
I don't believe I'm making any assumptions whatsoever about names.
Users must have WebIDs; that's part of the basic Solid architecture.
WebID description documents SHOULD include labels for the user identified by that WebID; that's part of a good WebID description document. The values of those labels are immaterial to this issue.
Are you're wondering what happens if two people with WebIDs
http://example.com/JoeSmith#iandhttp://example.com/JosephSmith#meboth have labelsJoe Smith?They each see the label
Joe Smithdisplayed with their WebID as thehrefbeneath the label and/or their WebID and/or IdP's label is displayed (and likewisehreffed) alongside the label as, respectively, for example --and
-- or --
and
I cannot imagine what else you might be wondering about in context of my issue, so perhaps you can provide more detail about your concern?
Ryuno-Ki commentedon Jun 21, 2019
Yes.
So the second option would be more … unique (albeit quite verbose). Thank you for explaining.
TallTed commentedon Jun 21, 2019
I'm not wedded to including the IdP in the display; these are just examples.
I'd be equally fine with --
and
-- or even --
and
-- as all of these include both the human-friendly label (in the human-visible literal) and the WebID (in the
hrefbeneath it)Ryuno-Ki commentedon Jun 21, 2019
My concern here is, that we should try to avoid impersonation attacks.
The WebID in
hrefis nice, but experience taught us, that people are not always checking that one before clicking (think phishing attacks).TallTed commentedon Jun 21, 2019
@Ryuno-Ki - I think, for impersonation, you're concerned with attribution displayed on something I post via my WebID, which might display the same label as your WebID?
That's a valid concern, and certainly underscores the need to have the WebID available wherever the label is shown -- and perhaps provides a reason to display the WebID in your scenario -- but it does not apply to the scenario at hand -- which should be showing the label (and maybe WebID) of the user logged into the Solid server/pod/whatever -- much as Amazon's website shows your name whenever you're logged in on their site (and not your email address, though that's what is used for the login username credential).
Your scenario is more akin to Twitter, where (depending on the app in use) the user may choose to see (or the app may choose to show) the
@handleor thelabel of the @handleor both. The@handlecan only be used by an authenticated user and is unique to that authentication; thelabel of the @handleis not unique, and the same label may be found on any number of@handles.Ryuno-Ki commentedon Jun 21, 2019
Okay, got it. Thanks for your patience in explaining it.