4 ms·

I don't get why OpenID was introduced in the first place then. The point of using an open auth protocol is to not become dependent on monopolies, isn't it? The

I don't get why OpenID was introduced in the first place then. The point of using an open auth protocol is to not become dependent on monopolies, isn't it? The figures being what they are isn't supportive of this decision when using OpenID is considered a strategic decision. I thought you could use Google at least (but not Fb) as OpenID Connect provider, so wouldn't it make more sense to deprecate support for Google-proprietary login schemes instead? Also, as remarked on the followup stackexchange discussions, this will make stackexchange login (against Google, Fb) JavaScript-only, won't it? Could somebody with more know-how clue me in about the state of affairs of OpenID and web auth?

fiddlerwoaroof 9y ago
I don’t think OpenID connect is the same thing as OpenID
- WorldMaker 9y ago
  "OpenID" Connect is absolutely not the same thing as OpenID and should never have had OpenID in the name.
  - billpg 9y ago
    Just wait until you hear about Javascript and C#.
willow9886 9y ago
> I don't get why OpenID was introduced in the first place then. Because the Internet needs standards to work. If all domains implement authentication differently, we do not have an interoperable network. As is customary, standards must evolve to keep up with requirements. OpenID 1 and 2 weren't built with the idea that smart phones would be in every persons pocket, or Internet connected devices in every home. The latest iteration of OpenID--OpenID Connect--is essentially Google's playbook for authentication. It's of huge value to the rest of the world. To put it simply: having your own OpenID Provider at your domain (e.g. idp.example.com) allows you to operate a similar authentication infrastructure as Google. What does that mean? - Single sign-on (SSO) across web and mobile applications - Ability to support a variety of strong authentication mechanisms (a.k.a 2FA), like U2F security keys and OTP mobile apps, in one place for many apps If all apps and services were to align with OpenID Connect, we would have a truly scalable and interoperable identity layer for the Internet.
- icebraining 9y ago
  But what's the point of OpenID Connect being interoperable, if unlike in OpenID, the providers are statically defined by the site and not dynamically discovered from the user input? If you want to have your own provider for your own sites, then you don't need it to be interoperable.
  - willow9886 9y ago
    OpenID Connect defines two important standards: Discovery [1] and Dynamic Registration [2]. All OpenID Providers publish their details at a publicly discoverable (and standard) domain: https://{hostname}/.well-known/openid-configuration https://{hostname}/.well-known/openid-configuration. For instance, you can see our OP meta data here [3]. This provides the foundation for using email as an identifier, i.e. in order to access protected resource at autonomous site, input email at a domain with an OP, and the RP can perform discovery to find where to send the user for authentication, and dynamic registration to register their client (app) with the OP to obtain user information ("claims"). [1] https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html [2] https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... [3] https://idp.gluu.org/.well-known/openid-configuration https://idp.gluu.org/.well-known/openid-configuration
    - icebraining 9y ago
      It's nice that the support is there, but are there any sites actually using it? My concern is that default matter - ie, if you make it easier to just support a few fixed servers, that's what will generally happen.
      - willow9886 9y ago
        Many sites are doing identifier first authentication, incuding google. When you login to google, it prompts you for an email address first. If your email is associated with an organization that has configured Google Apps to use their OP for authentication, Google will redirect the user to their home domain based on the email.

fiddlerwoaroof 9y ago

I don’t think OpenID connect is the same thing as OpenID

WorldMaker 9y ago
"OpenID" Connect is absolutely not the same thing as OpenID and should never have had OpenID in the name.
- billpg 9y ago
  Just wait until you hear about Javascript and C#.

willow9886 9y ago

> I don't get why OpenID was introduced in the first place then. Because the Internet needs standards to work. If all domains implement authentication differently, we do not have an interoperable network. As is customary, standards must evolve to keep up with requirements. OpenID 1 and 2 weren't built with the idea that smart phones would be in every persons pocket, or Internet connected devices in every home. The latest iteration of OpenID--OpenID Connect--is essentially Google's playbook for authentication. It's of huge value to the rest of the world. To put it simply: having your own OpenID Provider at your domain (e.g. idp.example.com) allows you to operate a similar authentication infrastructure as Google. What does that mean? - Single sign-on (SSO) across web and mobile applications - Ability to support a variety of strong authentication mechanisms (a.k.a 2FA), like U2F security keys and OTP mobile apps, in one place for many apps If all apps and services were to align with OpenID Connect, we would have a truly scalable and interoperable identity layer for the Internet.

icebraining 9y ago
But what's the point of OpenID Connect being interoperable, if unlike in OpenID, the providers are statically defined by the site and not dynamically discovered from the user input? If you want to have your own provider for your own sites, then you don't need it to be interoperable.
- willow9886 9y ago
  OpenID Connect defines two important standards: Discovery [1] and Dynamic Registration [2]. All OpenID Providers publish their details at a publicly discoverable (and standard) domain: https://{hostname}/.well-known/openid-configuration https://{hostname}/.well-known/openid-configuration. For instance, you can see our OP meta data here [3]. This provides the foundation for using email as an identifier, i.e. in order to access protected resource at autonomous site, input email at a domain with an OP, and the RP can perform discovery to find where to send the user for authentication, and dynamic registration to register their client (app) with the OP to obtain user information ("claims"). [1] https://openid.net/specs/openid-connect-discovery-1_0.html https://openid.net/specs/openid-connect-discovery-1_0.html [2] https://openid.net/specs/openid-connect-registration-1_0.html https://openid.net/specs/openid-connect-registration-1_0.htm... [3] https://idp.gluu.org/.well-known/openid-configuration https://idp.gluu.org/.well-known/openid-configuration
  - icebraining 9y ago
    It's nice that the support is there, but are there any sites actually using it? My concern is that default matter - ie, if you make it easier to just support a few fixed servers, that's what will generally happen.
    - willow9886 9y ago
      Many sites are doing identifier first authentication, incuding google. When you login to google, it prompts you for an email address first. If your email is associated with an organization that has configured Google Apps to use their OP for authentication, Google will redirect the user to their home domain based on the email.