Delegated Authentication is a new feature offered by Microsoft® that gives Windows Live ID users the ability to consent to the scoped release of their personal information to particular Web sites in a reliable yet flexible manner.
Delegated Authentication is a way to permit access to personal information, but with more precise control over access and usage permissions than the current binary decision—that is, fully on or fully off—that comes with the generally bad practice of handing over your account credentials to another Web site.
Data providers (also known as resource providers) such as the Windows Live Contacts service can register delegation offers that describe the access that a Web application or site (also known as an application provider) can request to a user’s data. The application provider can then request consent from the user by means of the Windows Live consent user interface (the consent UI) to one or more of those resource offers.
Based on the consent decisions the user makes, Windows Live ID gives the application provider a consent token that enables the provider’s Web site to act on the user’s behalf to access the specified services for a period of time defined by the user.
The consent token contains a delegation token, which authorizes a resource provider to provide scoped access to the user’s data in accordance with that user’s consent decisions, even when the user is not signed in. Stated another way, a delegation token enables application providers to act ”on behalf of” Windows Live ID users within the limits of both consent and constrained scope.
Windows Live Delegated Authentication is both a powerful enabler of a new class of user-centered Web services, and also an opportunity for users to take back control of their own personal data and make informed decisions before releasing that data to other parties.
You can read more about it here.
Subscribe