FEP-2c59: Discovery of a Webfinger address from an ActivityPub actor

Hello!

This is a discussion thread for the proposed FEP-2c59: Discovery of a Webfinger address from an ActivityPub actor.
Please use this thread to discuss the proposed FEP and any potential problems
or improvements that can be addressed.

Summary

[Webfinger][Webfinger] is used on the fediverse to abstract out variations in [ActivityPub][ActivityPub] actor URL formats, giving a uniform way of addressing an actor. With a Webfinger address, a client can discover the actor’s ActivityPub actor URL. This specification defines an explicit way to reverse the process, and discover a preferred Webfinger address from an ActivityPub actor URL.

1 Like

So, @mro had a few comments in the PR thread that I want to address. I’ll take them on one at a time. Here’s the original comment: #226 - [TRACKING] FEP-2c59: Discovery of a Webfinger address from an ActivityPub actor - fediverse/fep - Codeberg.org

@evan, the domain name in the property looks redundant, what if it doesn’t match the actor profile host?

I would recommend focussing on the local part and thus be local to the domain of the actor profile. Like Yaron Minsky recommends, don’t represent undesired state.

Is there a usecase for cross-domain?

The Motivation section goes into this in detail. The whole point is to allow cases where the Actor profile URL server part doesn’t match the Webfinger domain part.

1 Like

@mro also asks here #226 - [TRACKING] FEP-2c59: Discovery of a Webfinger address from an ActivityPub actor - fediverse/fep - Codeberg.org

why should redirects be forbidden? That sounds odd for a http protocol.

Redirects are forbidden to make confirmation of the link somewhat easier. If the actor URL is included exactly in the JRD document, you can confirm the correctness of the link with a string comparison, instead of following a bunch of redirects.

  1. What does JRD mean?
  2. I’m not sure, if i understand everything right. Is the following sample a valid one ?
{
    "@context": [
        "https://www.w3.org/ns/activitystreams",
        "https://purl.archive.org/socialweb/webfinger"
    ],
    "id": "https://dev.rdf-pub.org/ba26351d-c0a7-43d7-acf0-05281b2e8e44",
    "type": "Person",
    "name": "Evan Prodromou",
    "inbox": "https://dev.rdf-pub.org/c72e44cf-f6c5-42bb-84ce-454da88b1f45",
    "outbox": "https://dev.rdf-pub.org/63a1e94d-48a9-46a4-bfb5-67d11b973105",
    "following": "https://dev.rdf-pub.org/27b65665-406f-4baa-9ffb-8fcdde055908",
    "followers": "https://dev.rdf-pub.org/44e16e5d-9dc3-41b6-ba89-89d9798fd258"
    "webfinger": "evanp@dev.rdf-pub.org"
}

JSON Resource Descriptor – RFC 6415 - Web Host Metadata (ietf.org)

cool. I kind of would have expected this to be something like:

{
  "type": "Person",
  "id": "https://bengo.is",
  "alsoKnownAs": ["acct:localpart@bengo.is"],
  "@context": "https://www.w3.org/ns/activitystreams"
}
1 Like

I’m just curious. Was the existing as:alsoKnownAs considered for this purpose? I know Mastodon uses it as part of its actor move functionality, but it seems like it could be used in a more general way than that (more general than Webfinger, but useful for that purpose too).

For example, I could have an actor resource like:

{
    "@context": "https://www.w3.org/ns/activitystreams",
    "id": "https://subdomain.social.example/evanp",
    "type": "Person",
...
    "alsoKnownAs": [
       "acct:evanp@social.example",
       "urn:example:evanp",
       "did:uuid:whatever"
       "https://webid.example#me"
    ]
}

This could be used to resolve any of the values in as:alsoKnownAs to the actor URI using Webfinger or some other resolver. I’ve been considering also using this for non-actor objects to resolve alternative identifiers for objects in general.

I realize this may not address some implementation-specific issues when one of the AKAs is an internal account id for that implementation. I assume there would be internal ways to map the identifiers in those cases (like Mastodon’s statuses table that can map between account identifiers and actor URLs).

1 Like

The meaning of alsoKnownAs property is not well-defined. In my opinion, it should be used to describe different resources linked to the same entity (example: two actors representing the same person), this is how Mastodon uses it and how it is used in FEP-c390.

it shouldn’t be used to describe different identifiers of the same resource (e.g. actor ID and a corresponding acct URI), for that I’m proposing aliases property (in FEP-ef61).

Related discussions:

For alsoKnownAs, I just don’t know what the interaction with the Mastodon Move function would be. If it would interfere, I don’t think it makes sense to put forward a proposal for it.

sorry to say, but that’s an important part what http is about. Welcome to networking in a volatile, changing world. Redirects are an integral part of TimBls idea of cool uris don’t change. They are crucial http semantics.

Edit: Redirects are also explicitly mentioned in RFC 7033: WebFinger.

They are mandatory.

that’s a circular explanation rephrasing the question. What’s the usescase for differing domains?

I don’t think redirects are an important part of what JRD is. The point of the Webfinger lookup is to retrieve a canonical ActivityPub actor ID, not an URL for getting an ActivityPub actor profile.

I don’t think cool URIs not changing has anything to do with it. Tim Berners-Lee never wrote anything about how JRD links items shouldn’t change.

that’s a circular explanation rephrasing the question.

There’s a long motivation section in the document.

What’s the usescase for differing domains?

It’s the same use case as for using mro@domain.tld as your email address, rather than mro@mailserver.domain.tld. It lets organizations host their social server separate from their main Web site, but still use name@organization.tld as the Webfinger address.

1 Like

I should probably give some examples to be clearer. I can incorporate these into the FEP, too.

Here’s the example actor from the FEP:

{
    "@context": [
        "https://www.w3.org/ns/activitystreams",
        "https://purl.archive.org/socialweb/webfinger"
    ],
    "id": "https://social.example.com/evanp",
    "type": "Person",
    "name": "Evan Prodromou",
    "inbox": "https://social.example.com/evanp/inbox",
    "outbox": "https://social.example.com/evanp/outbox",
    "following": "https://social.example.com/evanp/following",
    "followers": "https://social.example.com/evanp/followers",
    "liked": "https://social.example.com/evanp/liked",
    "webfinger": "evanp@example.com"
}

If you get https://example.com/.well-known/webfinger?resource=acct:evanp@example.com, it should return something like this:

{
   "subject" : "acct:evanp@example.com",
   "links" : [
      {
         "href" : "https://social.example.com/evanp",
         "rel" : "self",
         "type" : "application/activity+json"
      },
   ]
}

The href should be exactly the same as the id of the actor. A client can confirm that the Webfinger address points to the ActivityPub actor without re-fetching the actor.

The following would not be OK:

{
   "subject" : "acct:evanp@example.com",
   "links" : [
      {
         "href" : "https://redirector.example/redirect?to=https://social.example.com/evanp",
         "rel" : "self",
         "type" : "application/activity+json"
      },
   ]
}
2 Likes

it probably makes sense to formally describe this flow in the FEP as well, using normative language – something like “prepend with acct: then resolve via the webfinger endpoint of the host component”? also consider requiring values of the form acct:evanp@example.com instead of evanp@example.com maybe?

1 Like

A Mastodon implementation expert can double-check this, but it doesn’t appear to me that the example I provided would cause a problem for Mastodon. It supports an array of as:alsoKnownAs URIs and checks for a matching member of that array during Move processing. The issue of Mastodon assigning different semantics to as:alsoKnownAs remains, but I don’t see a technical issue at the moment.

I believe as:alsoKnownAs could also be useful for Objects in general. Webfinger isn’t limited to finding information about people. I can imagine future scenarios where a URN is used for server-independent Object URIs and those can be resolved to local URLs using Webfinger (maybe even a federated Webfinger for that purpose).

The suggestion to use “aliases” doesn’t improve the semantic clarity since “also known as” is also known as “alias”. :wink:

That looks fine. The main advantage of this FEP is that you could also use a Webfinger address like:

"webfinger": "evanp@rdf-pub.org"

…as long as you’re able to change the Webfinger settings for rdf-pub.org.

The important thing is that it is obvious that there is no relationship between ‘id’ and ‘webfinger’. And between ‘id’ and ‘name’.

There was/is a problem with AndStatus regarding this relationship: issue

It doesn’t make sense to repeat the entire process of Webfinger discovery in the FEP. There’s an RFC for that.

The acct: format isn’t a Webfinger address. It’s an URL. I added it as optional, but prefer the bare format.

RFC 7565, Section 4 “Definition”:

Because an ‘acct’ URI enables abstract identification only and not interaction, this specification provides no method for dereferencing an ‘acct’ URI on its own […] Any protocol that uses ‘acct’ URIs is responsible for specifying how an ‘acct’ URI is employed in the context of that protocol (in particular, how it is dereferenced or resolved; see [RFC3986]).

so it probably bears adding at least a one-sentence statement as above. especially if you intend to allow/support the “bare address” without the acct:. (it might also be a good idea to pick one or the other instead of allowing both.)

another minor nitpick: the shorthand term wf:webfinger is slightly ambiguous or unclear, and would probably make more sense as webfingerAcct or acct instead.

2 Likes