Background

Providers

An OpenID provider authenticates a user's OpenID id, c.f. CAS server.

Consumers

An OpenID consumer is a web site that uses OpenIDs for authentication, c.f. CAS-enabled application.

Modules

Security Notes

  • It is relatively easy to create an OpenID provider that proxies some other authentication system. If users want to use a particular credential, someone will build the proxy. Organizations ought to consider providing an official service rather than letting an outsider develop a proxy.
  • OpenID asserts ownership of a URL (OpenID). This is more-or-less equivalent to any authentication system that will send password reminders to an e-mail address (which asserts ownership of that e-mail address).
  • In some ways, a system that will reset passwords based on a list of questions is the equivalent of single sign on. If the same questions and answers are used on multiple sites, compromise of one may compromise the others.

Leftovers

Random Notes

  • You can claim ownership of a URL
  • Pick your own provider
  • Relying party redirects you to provider
  • Automation of login? Same web-centric issues as CAS?
  • No labels