I have an app that is hosted on appspot and authentication is set to Federated Login. My app uses Google’s UserService to check if the user is logged in, and if necessary redirect them to a login page where the user can choose their OpenId provider, and then login. It all works fine.
In the case where the user chooses Google as their OpenId provider, if they then open a new tab and go to gmail (for example), gmail knows who they are – no login/authentication needed.
In the case where the user chooses Yahoo as their OpenId provider, if they then open a new tab in the browser and go to MyYahoo – Yahoo knows who they are – no login/authentication needed.
I am fine with this behavior – I just can’t figure out how logging in on my app let’s Yahoo know the user has authenticated. I don’t think it is the ACSID cookie, since I removed that and everything still worked.
It’s probably pretty simple, so many thanks in advance for taking the time to enlighten me…
This isn’t anything App Engine is doing – it’s part of OpenID. When you select an OpenID provider, you’re sent to that provider, who logs you in to authenticate you, before sending you back to the app. In the process, the OpenID provider logs you in with them (eg, Yahoo or GMail) too.