Does an OpenID provider have a history of everywhere I have used the account

openid

The title basically sums it up but I have an openid from myopenid, I am just curious if the record each time I use it.

Best Answer

In all likelihood, yes.

When someone attempts to log in to Super User with the OpenID "example.myopenid.com", Super User must contact MyOpenID and ask them to authenticate the user. MyOpenID will verify that they really are the owner of "example.myopenid.com", then return the result back to Super User.

Therefore, an identity provider (MyOpenID) knows each time a relying party (Super User) makes an authentication request.

Of course, nothing requires Super User to actually contact MyOpenID before logging you in as a particular user, but then it wouldn't really be using OpenID at all.

Related Solutions

Google-apps – use Gmail on Google Apps as OpenID provider

It seems like this was enabled last year. Here is the blog-post:

http://googlecode.blogspot.com/2009/07/google-apps-openid-identity-hub-for.html

Note: The Federated Login Service is disabled by default for Google Apps Premier and Education Editions. The domain admin can enable it from the Control Panel at http://www.google.com/a/cpanel/<your-domain>/SetupIdp.

The OpenID URL for Google Apps is something like:

https://www.google.com/a/<your-domain>/o8/ud?be=o8

What will the response plan be if your OpenID provider gets hacked

To make changing OpenID providers easy: set up some delegate on a domain you own. You then don't have to change all your accounts, but only need to change your own HTML.

On the Stack Overflow blog, Using Your Own URL as Your OpenID describes this, but does not include the 2.0 syntax. Like for myopenid.com, for both version 1 and 2:

<link rel="openid.server openid2.provider"
  href="http://www.myopenid.com/server" />  
<link rel="openid.delegate openid2.local_id" 
  href="http://youraccount.myopenid.com/" />  
<meta http-equiv="X-XRDS-Location"  
  content="http://www.myopenid.com/xrds?username=youraccount.myopenid.com" />

(Alternatively: take full control yourself, and become your own OpenID provider.)

Best Answer

Related Solutions

Google-apps – use Gmail on Google Apps as OpenID provider

What will the response plan be if your OpenID provider gets hacked

Related Topic