Question

I’m trying to create a user management system using steam openid, but I’m not sure what the table should look like. I’m used to having the basic user table containing the usual userid, username and password. Then using cookies confirming if the user is logged in. I’m not entirely sure on how to do this using steamopenID though.

I’ve completed the login and verification but have not yet figured out to have a working database with it. After successful login it returns the Users SteamID. What can I do with this to create a safe user system?

I was thinking of redirecting the user to a new page where they can register a username if the steamid itself doesnt exist, but how do I verify if a user is logged in our not using only the steamid?

Answer 1

You have two authentication providers, one from your own site or alternatively, one from steam. For the accounts you accept openid auths, you need to store their openid authentifications next to them, so when somebody logs into your site via an openid provider you find out which actual user of your site this is.

You session always is connected to your site’s user-id:

    [login] 
       |
[authentication]
       |
       \-----+--> [openid auth] ---> [steam id] --\
             |                                    |
             \--> [site user auth] ------> [site user id]
                                                  |
                                              [session]