[OpenID] Automatic OP-driven identifier selection leads to "wrong" OpenID URL
ChO₂
chemistrydioxide at quantentunnel.de
Wed Oct 5 23:31:18 UTC 2011
Dear List,
I have a question about OP-driven identifier selection. When I
authenticate with a RP using OpenID, my OP lets me choose between
several identifiers. Next time I log in to the same site, my OP will
automatically use the same identifier again and I am not given the
option to change this behavior. While this is very useful in most cases,
it may cause problems:
1) I cannot identify to the same RP with several different identities
that belong to the same OP account.
2) If a RP moves to a different URL and I choose the wrong identifier on
my next login, I'll be locked out from my RP account forever.
3) I cannot tell my OP to use a different identifier for a particular
RP, e.g. in order to confirm my email address.
4) When two RPs decide to merge, I will loose access to either account
and I can't merge the two accounts.
5) The OP may authenticate the user as the wrong identity even when the
user has entered a different but complete OpenID identifier.
Does someone have an idea how these issues are supposed to be addressed?
A possible workaround would be to modify the RP so that it pretends to
be a different RP on each log in (or when the user requests it to do
so). This would prevent the OP from automatically authenticating the
user with the "wrong" identifier.
I would also be interested to learn whether there's a way for RPs to
disable OP-driven identifer selection in OpenID v2.0 (i.e. the
identifier will be chosen by the RP, as in OpenID v1).
Regards, ChO2
More information about the general
mailing list