Question

I’ve been toying with the JanRain OpenID PHP Library, mostly following along with a tutorial I found on ZendZone.

How does one distinguish between users – especially Google users, who all end up using the same OpenID URL, https://www.google.com/accounts/o8/id ?

Basically, I’m at the point where I can detect that they have an OpenID account… that they’ve successfully authenticated… but my app still doesn’t know who they are; only that they authenticated.

To distinguish users, the tutorial uses a “Simple Registration request” to request the user’s email of the OpenID provider – and then use email address to see if this is a returning user.

It wasn’t working for me, and apparently won’t work with some providers so I was excited when I stumbled upon a function getDisplayIdentifier.

require_once "Auth/OpenID/Consumer.php";
require_once "Auth/OpenID/FileStore.php";
// create file storage area for OpenID data
$store = new Auth_OpenID_FileStore('/wtv');
$consumer = new Auth_OpenID_Consumer($store);
$oid_response = $consumer->complete("http://example.com/oir_return");
if ($oid_response->status == Auth_OpenID_SUCCESS) {
    $hopefullyUniqueUserID = $oid_response->getDisplayIdentifier(); // I assumed this would be a relatively permanent way to identify the user...
                                           // I was wrong.
}

Unfortunately, after a couple of hours the value returned by getDisplayIdentifier changes.

Answer 1

The problem was that Google’s OpenIDs are Unique Per-Domain; I had been absent mindedly alternating between http://www.mysite.com and http://mysite.com, which caused the OpenID identity url to change!