Converting your site to OpenID

If you currently run a site with a large number of users and are looking at adopting OpenID you have a few things you need to consider. I’ve been talking with Larry Halff from the social bookmarking site Ma.gnolia (which kicks ass btw) and they are looking at adopting OpenID. Larry has quite a few users and so he had to take those folks into account before implementing OpenID.

What we have seen with the open source projects that are adopting OpenID is to simply tie it to an actual account within the system. For example, the Drupal plugin does this. This is the easiest mechanism since you can then tie the OpenID to attributes that you need specifically for your application. In the case of Drupal, they have the concept of an avatar. OpenID’s simple registration does not have this attribute so you can’t get it from the identity provider (yet - more on that later). So when a user logs in with an OpenID, their OpenID is tied to a new account within that Drupal installation. Then you get the benefit of all of the “extra” attributes that you might want to have for that account.

In Larry’s case at Ma.gnolia, when the user logs in for the first time, they ask for the ‘nickname’ of the user via the simple registration mechanism. When they get that back from the users’ identity provider, they check to see if it matches an existing Ma.gnolia account. If it does, the user is presented with a dialog to enter that Ma.gnolia user’s password. This allows the user to link an existing Ma.gnolia account to an OpenID (so they don’t have to re-enter all of their bookmark information again). If it doesn’t match, they create a new Ma.gnolia account and tie it to the OpenID via a seperate OpenID associations table.

Now, as I mentioned before, simple registration is pretty limited in its abilities at this time. However, there is a mechanism for arbitrary attribute exchange that has been proposed. In the case of Drupal, a site running Drupal could upload attributes that would be tied to the user at their identity provider (with the users’ permission of course) and these attributes could be used for any Drupal site. The ability to have rich profile information via attribute exchange is something that is going to make OpenID a really powerful platform for delivering digital identities.