OpenID Authentication by example

OpenID Authentication
by example
BPW2007
chrisv.cpan.org

(introductory slides: thanks to Simon Willison)

Saturday 27 October 2007 1

usernames & passwords
suck


signing up for new
accounts is a pain


my online identity
exists in multiple
(hard to manage) places


user database theft


password/cc info theft


too much passwords,
too much userids


we need single signon


uniﬁed, trusted
identity


OpenID is a
decentralized
mechanism for
single signon


OpenID is a URL


http://vertonghen.livejournal.com


http://vertonghen.myopenid.com


http://chris.vertonghen.org


The OpenID protocol
lets you prove that you
own a speciﬁc URL


An OpenID can be
used as an
authentiation credential


Site: “Who are you?”


Me: “I’m chris.vertonghen.org”


Site: “Prove it”


(some magic happens)


Site: “ok you’re in!”


Picking an OpenID is
like picking an email
provider - you ﬁnd one
that you trust


If you have the ability to
run your own server
software, you can do so
yourself


http://www.wooblelab.com/
(demo)


So my users don’t
have to sign up for an
account?


Not necessarily


An OpenID tells you
very little about a user


You don’t know
their name


You don’t know
their e-mail address


You don’t know
if they’re a person
or an evil robot


You have to ask them!


OpenID can help them answer


(demo)
http://www.welovelocal.com/


So how does
OpenID work?


Use multiple OpenIDs to
maintain multiple online
personas


professional
social
secret
...


OpenID and web
service APIs naturally
complement each other


Me: “I’m
vertonghen.myopenid.com”


Site fetches HTML,
discovers identity provider


Establishes shared secret
with identity provider
(Using Difﬁe-Hellman key exchange)


Redirects you to the
identity provider


when you’re logged in there,
you get redirected back


How does my identity
provider know who I am?


OpenID deliberately
doesn’t specify


username/password
is common


But providers can
use other methods if
they want to


Client SSL certiﬁcates


Out of band
authentication via SMS,
e-mail or Jabber


No authentication at all
(just say “Yes”)
(which is the OpenID version of bugmenot.com)


What if I decide I
suddenly hate my provider?


Use your own
domain name


and delegate to a
provider you trust


perl OpenID client


Net::OpenID::Consumer
by Brad Fitzpatrick (of course)


use Net::OpenID::Consumer;

my $csr = Net::OpenID::Consumer->new(
ua => LWPx::ParanoidAgent->new,
cache => Some::Cache->new,
args => $cgi,
consumer_secret => ...,
required_root => quot;http://chris.vertonghen.org/quot;,
);

# a user entered, say, quot;bradfitz.comquot; as their identity. The first
# step is to fetch that page, parse it, and get a
# Net::OpenID::ClaimedIdentity object:

my $claimed_identity = $csr->claimed_identity(quot;bradfitz.comquot;);

# now your app has to send them at their identity server's endpoint
# to get redirected to either a positive assertion that they own
# that identity, or where they need to go to login/setup trust/etc.

my $script_name = quot;http://quot; . $ENV{'HTTP_HOST'} . $ENV{'SCRIPT_NAME'};

my $check_url = $claimed_identity->check_url(
return_to => $script_name
. quot;?return=true&hurl=$hurl&oid=quot;
. $m->interp()->apply_escapes($identity),
trust_root => quot;http://chris.vertonghen.org/quot;,
);

# so you send the user off there, and then they come back to
# openid-check.mhtml, then you see what the identity server said;
if ($return) {
if ( $setup_url = $openid_con->user_setup_url ) {
print $m->redirect($setup_url);
}
elsif ( $verify_identity = $openid_con->verified_identity ) {
$verified_url = $verify_identity->url;
print 'Congratulations your identity has been verified.<BR><BR>';
}
elsif ( $openid_con->user_cancel ) {
$m->redirect('http://chris.vertonghen.org/auth.html'); #use the file name of the login page
}
else {
print quot;<BR><h1>Validation Error</h1>quot;;
print 'There was an error in validating your identity. The error was ', $openid_con->err
. quot;<BR><BR>Please <a href=quot;javascript: history.go(-1);quot;>go back and try again</a>.<BR><BR>quot;;
}
}


Thank you.

Questions?


OpenID Authentication by example

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Empfohlen

Empfohlen (20)

OpenID Authentication by example