Question

I’m beginning to seriously doubt the OpenID community despite that fact that it works.

I’m in the process of currently evaluating OpenID as an authentication service for ‘this’ site and while the promises are great, I just can’t get it to work. And I’m really lost.

I ask of the SO community to help me out here. Give me answers and show me examples so I can leverage this in the way it was meant to be.

My scenario is very typical. I want to authenticate users through a specific Google Apps domain. If you have access to this Google Apps domain, then you have access to my web application.

Where I get lost, is all the prerequisites and dependencies involved.

1. What is XRD?
2. What is Yadis?
3. Why do I need XRD and Yadis?
4. What do I need to do to deploy OpenID authentication on my website?

Also, this is really important to me.

When I login to SO, I use my Google Account. When I click the login button I’m presented with this confirmation page. Where I’m granting SO the right to use my Google Account credentials.

Somehow, Google knows that it’s “Stackoverflow.com” that’s asking me if it’s okay to login. And I wish to know what manner of control I have over this little text. I intend to deploy OpenID on several different domains but I would prefer if they would all work without having to be individually configured with special parameters, such as secret API keys and what not. However, I don’t know for sure if this is a prerequisite of OpenID, that or the Federated Login API that Google provides.

Answer 1

I’ve actually found a solution to my problem, and surpsingly so, it was very simple. I still don’t understand XRDS and Yadis but I’m leveraging it quite easily like so.

What you want, and what you’re looking for is code for doing the OpenID “relaying party” stuff. That’s “you” as a consumer of OpenID providers. You enter an OpenID endpoint and voila, you’ve OpenID enabled your site, this code illustrates that in practice.

// using DotNetOpenAuth
var openid = new OpenIdRelyingParty();
var response = openid.GetResponse();
if (response == null)
{
    // Google account end point (works fine)
    var googleID = "https://www.google.com/accounts/o8/id";
    // Google hosted account end point
    //  https://www.google.com/accounts/o8/site-xrds?hd=mydomain.com
    // I was unable to test this, but I was running my RP (this code)
    // from localhost and it's quite possible that a hosted account RP
    // has to return to the same domain.
    // It went fine, but crashed with a "Unable to resolve mydomain.com" error
    // once I logged in.
    openid.CreateRequest(googleID).RedirectToProvider();
}
else
{
    switch (response.Status)
    {
        case AuthenticationStatus.Authenticated:
            // Success
            // to allow persistance across sessions
            // you'll have to track the "claimed identifier"
            // some OpenID providers allow you to get an email address through
            // extensions but this is not always possible.
            // the claimed identifier is typically your safest bet
            // and it's a big URL which uniquely identifies the guest
            // as a specific user, however, you know very little about this user
            // which is a good thing becuase you don't have to give out personal or
            // sensitive information to start using a service.
            break;

        default:
            // Something went wrong, check Status property
            break;
    }
}

While I was figuring this out, I got the impression from every spec. out there that I was supposed to host my own “OpenID provider” that made it sound like I was supposed to handle accounts or some part of the process. In reality all I had to do was this.

Request that URL, or if you recieve a OpenID request in response. Check to see if that request contains valid login information.