== B. Issuer ==
, consortium, group or individual who issues badges into the OBI. The OBI is open and supports any independent Issuer that conforms to the necessary badge and issuing specifications.
=== I. BACKGROUND ===
=== II. REQUIREMENTS ===
* Issuers must have web server capable of serving requests to the general
internet* Issuers must have hosting ability
* Issuers must have ability to make a POST request from their server backend and read a JSON response.
* Issuers must have email addresses for
Earners and must be able to email Earners
* Issuers must have badges (or be able to convert their badges) into the format (metadata spec) that the Assertion expects.
* Earners must be registered with
whatever Backpack the Issuer is trying to push badges to, or (for later versions) the Issuer must ask Earner which Backpack they want to push badges to and honor that request
* For verification:
** If doing Hosted Assertions (currently available)*** Issuers must maintain a server with the Badge Assertion information (at the unique badge URL) to verify each badge ** If doing Signed Assertions
=== III. BADGE CREATION FLOW ===
# Have an email address for the
Earner# Create and host an Assertion on your site
# Create and host the badge PNG; this is a single PNG for all badges, not a single physical PNG per issued badge.
# Integrate your site with the Backpack via the Issuer API
n.b. The Issuer API is a script that can be dropped -in to any Badge Issuer's website to provide a way for Earners to add an Issuer's badges to their Backpack. There's no need to bake the badges yourself. The API takes care of it for you.
=== IV. OPEN BADGES Related Widgets created by the community ===
=== V. Open Badger ===
is a lightweight OBI compliant badge issuing platform. It will make creating and issuing badges easy for non-technical users.
We've done some [https://github.com/mozilla/OpenBadger/wiki/Speculation speculation] but more to come on the [https://github.com/mozilla/openbadger Open Badger github].
== C. Badge ==
The core currency of exchange. A single credential demonstrating a skill, achievement, quality or affiliation. * Representation - Assertion url representing chunks of JSON data embedded into a PNG file* [https://github.com/mozilla/openbadges/wiki/Assertions Badge Assertion aka Badge Manifest] - Earner identity information (<algorithm>$<hash(email + salt)>) plus badge information (JSON metadata) * Verified Badge - Badges that have an assertion URL. OBI currently supports verification of badges through Hosted Assertions . i.e. When Issuer pushes badge to the OBI, metadata is pushed to a unique and persistent url aka assertion url. Issuer maintains Badge Assertion and Displayers can ping the assertion URL to confirm verification . ** n.b. Signed Assertion is on the [https://wiki.mozilla.org/Badges/roadmap development roadmap]. * Endorsed Badge - Badges that have been signed by a third party /endorser. The Backpack verifies the signature against the signer’s public key and if confirmed, accepts the badge as an endorsed badge. The endorsement information is represented with the badge as a layer of trust on the badge’s validity. ** n.b. On [https://wiki.mozilla.org/Badges/roadmap development roadmap] for 2012
== D. Backpack ==
Backpack is an authorized data storage
plus a management interface for earners of Open Badges. Each earner will have their own Backpack that holds all of their badges and gives them an interface to manage , control and share their badges. * The Backpack as well as the entire system is open source and federated. Earners or Issuers can take the [https://github.com/mozilla/openbadges code] and fork it.
* Earners may decide to create and host their own Backpack so that they have complete control over their badges.
* Mozilla has built a reference or default Backpack which
will hold all of the badge Assertions (hashed user email + badge data) for each earner.
== E. Metadata Spec ==
=== I. OVERVIEW ===
* A badge is an assertion
url representing chunks of JSON data embedded into a PNG file* The metadata should carry all the information needed to understand a badge. This ensures that badges can be fully understood and verified no matter where they are shared or used.* This is the data presented in the Assertion URL on the Issuer's server
=== II. FIELDS ===
*** version: The version of the badge
*** name: Human-readable name of the badge being issued. Maximum of 128 characters.
*** image: URL for image representing the badge. Should be a square and in PNG format. Maximum size
*** description: Description of the badge being issued. Maximum of 128 characters.
*** criteria: URL describing the badge and criteria for earning the badge (
Not the specific instance of the badge).*** issuer: Information about the Issuer: **** origin: Origin of the Issuer. This is the <protocol>://<host>:<port>. Must match the origin of the Hosted Assertion (and in the future, the origin of the public key).
**** name : Human-readable name of the issuing agent.
** evidence: Earner-specific URL with information about this specific badge instance. Should contain information about how the
specific Earer earned the badge.
** expires: Date when the badge expires. If omitted, the badge never expires.
*** The badge is not removed from the
Earner’s Backpack after the expiration date – there will be some visual/technical indicator that the badge is expired and needs to be re-upped. Must be formatted "YYYY-MM-DD" or a unix timestamp** issued_on: Date when badge was issued. If omitted, the issue date will be set to the date the badge was pushed to the Backpack. Must be formatted "YYYY-MM-DD" or a unix timestamp
** issuer: Information about the Issuer:
*** org: (OPTIONAL) Organization for which the badge is being issued. An example is if a scout badge is being issued, the "name" of the Issuer could be "Boy Scouts" and the "org" could be "Troop #218"
*** contact: (OPTIONAL) A human-monitored email address associated with the Issuer.
* n.b. We've discussed having an additional field that is customizable by the Earner - so that the Earner could add a personal evidence URL, or could add additional information or context to the badge. This would NOT be something that the Issuer would include in the Badge Assertion (so it is not listed above) and would most likely be managed by the Earner through the Backpack. * n.b. Issuers can put a reasonable amount of extra material into the badge, but that material must be static -- once the badge is issued, any change to that information must not change. This is to prevent someone from issuing one badge, then sneakily changing it later to another badge unbeknownst to the Earner. There currently isn't a method for updating the information received in the badge, though it's not off the table.
== F. PNG Files / Badge Baking Service ==
=== I. BACKGROUND ===
* Each badge is a JSON blob of metadata embedded in a PNG file * This allows the badge to be more easily portable - an actual
'thing' that can be emailed around , carrying all the information with it * Ultimately, this is important for decentralization of the system - so that Earners have more control over where their badges live
=== II. BETA: BAKING SERVICE ===
* For beta, Mozilla will be providing a [https://github.com/mozilla/openbadges/wiki/Badge-Baking 'baking' service] to package the JSON into a PNG file * REQUIREMENTS: To bake a badge, you must be hosting a Badge Assertion on your site. ** See the Assertions page for details: https:// github. com/mozilla/openbadges/ wiki/Assertions* Issuers will still send the Badge Assertion to Mozilla, but instead of sending it directly to the Backpack, they will now send it to the Mozilla Baking Service. Then Mozilla will package it into a PNG and deliver back to the Issuer who can then send to the Earner
** The purpose of this is:
*** A) to avoid SPAMing the Earner with unwanted badges
(which we can control in beta) and
*** B) to give the Earners ultimate control over where the badges go.
will provide the 'tools ' for unpacking the PNG file through the OBI * PNG files will be unpacked in the Backpack where each Earner can view, manage and organize their badges (and see all the metadata behind each badge)
* PNG files will be unpacked for the Displayer API so that Displayers will just have the raw data to work with on their end.
=== III. BADGE IMAGE STANDARDS ===
* Image must be a PNG
(for Beta). ** Potentially: In later iterations, we can convert to a PNG * Images should be square and not exceed 256kb * Looking at standardizing dimensions to 90 x 90 * Image is provided as a URL to the image on the Issuer server in the metadata * Mozilla will cache the image in at least 2 sizes * When a badge is displayed, it will be loaded from the Mozilla cache to avoid extra burden on the Issuer servers , also in case the Issuer is not available or link is broken
== G. Verification ==
=== I. OVERVIEW ===
* To avoid gaming and duplication, the OBI is built to support badge verification.
handles the questions of "Did this Issuer issue this badge to this Earner on this date? Is this badge still valid or has it expired?" * The OBI provides the channel for this verification to happen through the Backpack , but must communicate with the Issuer. * Issuer must be online to verify badges. ( we are exploring a cache to cover verification for x amount of time) * Most verification will be done by the Displayers. Displayers should not display a badge that cannot be verified.
=== II. VERIFICATION METHOD ===
* OBI currently supports verification of badges through Hosted Assertions
. i.e. When Issuer pushes a badge to the OBI, metadata is pushed to a unique and persistent url aka assertion url. Issuer maintains the Badge Assertion and Displayers can ping the assertion URL to verify the badge.** Displayer puts the Earner’s email through a salted hash function and sees if it matches with the hash value indicated for the recipient in the badge metadata. If values match, the badge belongs to the Earner that claims it, if not, it is being spoofed. ** Cons: Overhead for Issuer to maintain unique and persistent url for each badge.* In the future we will support Signed Assertions, which will mean signing a badge assertion with your private key and hosting a public key at a well known, public URL. ** Pros: Less overhead for Issuer, just need to host public key* Further down the road, we will probably try to support DNSSEC for public key discovery.
* Unverified Badge handling
** If badge is passed through by an
Issuer and the signature (when we support this method of verification) is invalid, OBI rejects it. ** If badge is verified initially but somewhere down the line it becomes unverified, OBI notifies user. [Needs to be worked out more. ]
=== III. FUNCTIONAL FLOW ===
# Badge (within it, its assertion) exists in the Backpack # User attempts to display badge via a display site widget
# Display site takes the earner’s email and puts it through a salted hash function.
## eg. hash (‘firstname.lastname@example.org’ + salt)
# Display site compares the resulting value with the value indicated for the recipient in the badge metadata.
# If values match, badge is verified and
Displayer displays the badge. If not, Displayer should reject the badge.
== H. Displayers ==
* Display of badges is where a significant part of the value lies
- badges are not siloed or 'stuck' within one site but can be combined with badges from multiple Issuers and then shared out for different audiences /purposes * Earner will control where badges are displayed through the Backpack * Earner can create groups of badges and share through the Backpack to Displayers that have connected via the [https://github.com/mozilla/openbadges/wiki/Displayer-API Displayer API] * Earners can also make badges public - in that case, those badges would be discoverable by Displayers if they had the Earner’s email address * At its most basic: if a site has an Earner's email address, they will be able to query the Backpack for all of Earner's public badges. They will get back JSON representation of the badges
== I. Identity ==
=== I. OVERVIEW ===
* Identity is a critical
part of the OBI because we need to know/recognize an Earner all across the web as they collect badges from different Issuers/sites * Identity needs to be open and decentralized * We are utilizing verified email as identity through the use of the Mozilla product called Persona ** Mozilla. com is working on a solution called Persona, fka BrowserID, the first version of the Mozilla Verified Email Identity
** Additional info: https://browserid.org/, https://wiki.mozilla.org/Identity
* People understand the concept of an email address ** c.f. They have difficulty understanding OpenID * Many sites already use email for login ** Even those that don't generally collect it (for resetting password) * We don't need to retain any profile or personal information about the Earner, all we need is the email address.
=== II. FUNCTIONAL FLOW FOR VERIFYING IDENTITY IN BACKPACK ===
# User validates identity to Mozilla's Verified Email # User creates an account with Mozilla (same as sync account)
# User asserts which email addresses he or she owns.
# User does an SMTP challenge (system emails user a token link they must click) to prove ownership