I’m just brainstorming, and don’t really know much about these technologies yet. What I want to do is provide an easy and secure for users to prove who they are across multiple web sites, and I want to provide a way for web sites to share certain information with each other (if the user gives them permission). After a little reading, it seems like OpenID and OAuth would be the best way to solve this problem (right?).
After searching, I’ve found two interesting projects. One is “Step2” which only has Java libraries (not a problem for me, but other, partner websites might not be coded in Java), and looks like it has been abandoned. Another is “OpenID Connect,” which doesn’t look like it’s even been started.
So, I’ve guess I’ve got three questions. Is linking OpenID and OAuth what I should be doing? Is there a OpenID+OAuth project that has a lot of support? If not, would it be easy to integrate the two myself?
OpenID is interesting in cases like Stack Overflow where you want to let people log in with external credentials but not with the intent of exchanging data with that external site.
But I don’t think you need OpenID for the scenario described… by putting users through the OAuth flow, users are effectively “proving who they are across multiple web sites” as part of the authorization process.