Scott Kveton

I wanted to take a chance to show people the actual flow of OpenID as well as cover some of the terminology. Consider this a virtual kick-the-tires of OpenID.

As I mentioned in my last post, OpenID is a decentralized, light-weight authentication mechanism for the Internet. It doesn’t do trust, reputation or much of anything else today. However, it is an open platform that anyone can participate in. The OpenID community believes simple is good and that having an open platform means more people are likely to use/develop/engage than if it was driven by one vendor or consoritia.

Alright, so let’s dig in. The first concept to understand is the Identity Provider (IdP for short). The Identity Provider is where the user serves up their identity. It’s a URL. In my case, I am http://kveton.myopenid.com. Now, I could easily be http://kveton.com or http://scott.kveton.com or http://scott.really.likes.openid.kveton.com but I chose to use a third-party IdP to deliver my identity for me (full-disclosure: myopenid.com is a free product developed by my company JanRain). Since OpenID is an open protocol, I could host my identity on my Linux machine at my house behind my DSL line if I want to. This is entirely up to the end-user (and of course their ability to deploy their own IdP if they choose that path).

Here are some screenshots of the IdP that I use:

The first one is the main screen when you show up at MyOpenID.com. Clicking “Sign Up Now” takes you to the sign up page (the second screenshot). Finally, the last one is of me actually typing in my OpenID of http://kveton.myopenid.com into the IdP and logging in.

(My point here isn’t to show off our IdP. There are plenty of other IdP’s that have a lot of the same functionality. Verisign has one. Four Kitchens has one. Pretty soon everyone will have one! But I digress.)

Now for the next round of snapshots!:

The first one shows your “homepage” when you login. This is really just a place for you to administer your personal information, etc. The second shot shows you the sites that I have listed as my “trusted” sites. More on this in a moment. Finally, you can see the rest of the information that I can fill out that can be used on other sites. Again, more on that in a moment.

So let’s see this in action. Remember, I already logged into my IdP so I’m ready to hit the Internet and find some sites that support OpenID. A great example is Zooomr (aka Flickr on steroids:

The first shot is of me entering my OpenID into Zooomr to login. The second shot is the interesting one.

Zooomr sees that I’m trying to login with http://kveton.myopenid.com. Zooomr heads over to that URL to authenticate me. Now, since I’m logged in, I get presented with the second screen above. If I wasn’t logged in, I’d be asked for my password. As you can see, Zooomr is asking for some information form me. This utilizes something OpenID v1.1 called simple registration. We realized that without some bit of information about the users, sites that would implement OpenID would actually take a step backwards which was a bad thing. So simple registration (SREG) was added to the specification to allow the transfer/exchange of 9 different attributes about the user. As you can see in the screenshot, the user is asked if they would like to give up some information (in this case, nickname, full name and email) and what duration they would like that to last for. This is great and super powerful for the users; now they know what they are giving to the site in question. Very cool.

I know what you’re thinking; only 9 attributes?! That stinks!! Well, we agree but we’ve got to start somewhere and that’s where we started. Remember, OpenID is simple and light-weight. Moving attributes back and forth is really a profile exchange issue; one that will be addressed soon. Lots of folks are thinking about this right now and OpenID v2.0 will have the means to let those things hook in seamlessly.

The third shot shows what the user sees after they agree to the information exchange. Voila. Okay, great. We’ve logged into a site. What did that do? More importantly, what now?

The first shot above is the list of trusted sites that I have for my identity served up by my IdP. Notice that “anything.zooomr.com” entry now? Anytime I go to Zooomr now (unless I clicked the “For this session only” button when logging in) I’ll be automagically logged in. The next shot shows me going to another site, schtuff.com (full-disclosure; JanRain site), where I already have “anything.schtuff.com” in my trust list. Since I’m logged into my IdP and since I already trust schtuff.com, I’m logged right in. Up in the left hand corner of that screenshot you’ll see my OpenID URL and links to my site preferences, etc. All very seamless, all very simple, all very easy.

So that’s the OpenID walk through in a nutshell. Now go spread the word about how great OpenID is!