Hacker News Reader

Comment by lmz | Hacker News Reader

"If AOL, my current delegate, decides to get out of the OpenID business entirely, one minute with vim on my website allows me to move it somewhere else, again, all along,"

I doubt that. "http://jerf.org is a string that you type into the OpenID box ("endpoint URL"?), not the ID itself. I use Google Apps and set my site up using an X-XRDS-Location header so I can type in "http://id.example.com into the box, but the identity the site gets is something like "http://example.com/openid?id=123456789. This identity will probably change if I switch to using AOL.

View on HN

So, I just tried this, and it seems the answer is "it depends". AOL actually let me appear as "jerf.org", so it is not unreasonable that I thought this was the case. When I switched to using Yahoo, my OpenID got translated back to their idea of my id when I used it to log in. And I started flipping out, but decided to verify with another source before screaming too much. So I signed up for myOpenID and delegated to them, and once again I could appear as "jerf.org". I verified this using StackOverflow; with Yahoo I ended up on one account consistently, but with myOpenID and AOL I ended up on the "jerf.org" account regardless. I also verified StackOverflow was actually hitting my site on each request and not just caching my page.

So unless I screwed up, it is possible for it to work the way I describe, and it is possible for it to work the way you describe, depending. I'm calmed back down, but in general that's pretty worthless. I can not imagine why it should not always work the way I describe, it's the entire bloody point. Providers shouldn't even be able to screw me over that way.

You have been bamboozled by OpenID lingo. Don't worry, it happens to the best of us. jerf.org is a User-Supplied Identifier which the Relying Party will perform Discovery on to resolve to an Endpoint URL at the OpenID Provider where the Claimed Identifier, which is possibly an OP-Local Identifier, will be resolved to an Identifier. None of these words mean what you think they mean. Identifiers look like URLs, but aren't, except when they are.

Have I mentioned recently that implementing OpenID is a source of endless amusement?

Ugh. I take it that the lesson to take from all this is "stay away". Got it.

Not if the provider implements delegation properly. The identity string returned should be http://jerf.org in this case.

The catch, however, is that many providers screw the identity up. For example I set up a page at http://foo.com with necessary headers to delegate to my Google Account. Using the OpenID support on App Engine, I get the federated identity as http://foo.com/openid?id=[SOME RANDOM DIGITS] instead.

The idea of OpenID and delegation is awesome. In reality the millions different implementations fked up the whole thing, not even to mention the control and reliability issues.

Oh by the way, one more thing: if you supply https://foo.com instead of http://foo.com to App Engine you'll get completely different identity back as a result. This is just pure fun.

From what I remember of my OpenID provider search a few months ago, not all providers have chosen to support delegation. Google doesn't support it, but myOpenID does (I went with the latter, then never used it again). But it's not a "screw up", it's a (questionable) policy decision.

Reply on news.ycombinator.com