OpenID

From YobiWiki
Jump to navigation Jump to search

Links

Understanding

http://leancode.com/wp-content/uploads/2007/02/openid_protocol.png

Identity provider (OpenID provider)

Service providers

Be your own!

  • phpMyID
    • Standalone, single user, OpenID Identity Provider
    • Very easy to set up!
    • Authentication based on HTTP Digest
    • Supports also pavatar and MicroID
    • You'd better use it with php5 as php4 is lackind the modpow operation and the emulation is very slow.

Recipes

  • There is an example given with php-openid
    apt-get install php-openid
  • OpenId for non-SuperUsers, using phpMyID, a fallback OpenID service provider and some delegation so you can use e.g. your blog URI as identity.

Relying Party (Consumer)

Mod Auth OpenID for Apache

apt-get install libapache2-mod-auth-openid

Recipes

My services

Libraries

Security

Some are worrying about easier phishing attacks as the relying party could redirect you to another identity provider than yours.
That's why it's good to have diversity and to have your own identity provider hosted at your own server, with your own style and your own authentication method
If there will be phishing, that will occur for the big OpenID providers.
But if you're using a self-signed SSL identity server, for sure man-in-the-middle SSL attack can occur much more easily so don't rely on it!
Using Digest access authentication through e.g. Apache AuthDigest over HTTP is probably a much better idea than Basic access authentication over HTTPS.