3 ms·
Not if the provider implements delegation properly. The identity string returned should be http://jerf.org http://jerf.org in this case. The catch, however, is
by riobard 16y ago
Not if the provider implements delegation properly. The identity string returned should be http://jerf.org http://jerf.org in this case.
The catch, however, is that many providers screw the identity up. For example I set up a page at http://foo.com http://foo.com with necessary headers to delegate to my Google Account. Using the OpenID support on App Engine, I get the federated identity as http://foo.com/openid?id=[SOME http://foo.com/openid?id=[SOME RANDOM DIGITS] instead.
The idea of OpenID and delegation is awesome. In reality the millions different implementations fked up the whole thing, not even to mention the control and reliability issues.
- riobard 16y agoOh by the way, one more thing: if you supply https://foo.com https://foo.com instead of http://foo.com http://foo.com to App Engine you'll get completely different identity back as a result. This is just pure fun.
- gxti 16y agoFrom what I remember of my OpenID provider search a few months ago, not all providers have chosen to support delegation. Google doesn't support it, but myOpenID does (I went with the latter, then never used it again). But it's not a "screw up", it's a (questionable) policy decision.