4 ms·
> All OpenID Providers publish their details at a publicly discoverable (and standard) domain: https://{hostname}/.well-known/openid-configuration https://{host
by vertex-four 9y ago
> All OpenID Providers publish their details at a publicly discoverable (and standard) domain: https://{hostname}/.well-known/openid-configuration https://{hostname}/.well-known/openid-configuration.
No, no they don’t. Not by far. Google, for example, doesn’t - and even if they did, it wouldn’t be useful, as they don’t support dynamic client registration either, as they want lock-in. Being able to type in my email address into a generic widget and get the Google auth dialog is specifically what they don’t want.
Facebook has the same issue, as does Yahoo. I don’t think I know of a single implementer of OpenID Discovery and Dynamic Client Registration - the only purpose of OpenID Connect as deployed in the wild is to share development resources, not to create a system where people can type in their email address into a generic widget which works for every OpenID Connect supporting domain off the shelf with no RP-side configuration and get a login form.
- willow9886 9y agoYes they do. See here: https://accounts.google.com/.well-known/openid-configuration https://accounts.google.com/.well-known/openid-configuration And as far as I know, Facebook doesn't support OpenID Connect. They still roll their own custom OAuth2 implementation.
- vertex-four 9y agoThat is, obviously, not on gmail.com. I cannot put in my email address into a generic widget and have that come up - the URL has to be hard-coded into the RP, and the RP additionally has to be configured with client authentication details. This document cannot be autodiscovered from a user identifier as per the spec, and provides absolutely nothing over hard-coding the configuration it contains.