Comments on: OpenID login and APIs

By: Anonymous

Anonymous — Thu, 10 Jul 2008 17:09:06 +0000

What are the differences between OpenID and Shibboleth? http://en.wikipedia.org/wiki/Shibboleth_%28Internet2%29

By: Lefty

Lefty — Thu, 10 Jul 2008 08:42:12 +0000

Comments look fine in FF3, but not on my Diablo-ized N810…

By: Erwan

Erwan — Thu, 10 Jul 2008 01:44:42 +0000

I think that Ma.gnolia.com has already done some research about that. They have an API, they provide OpenID login but you can’t use the API with OpenID.

Last time I talked to them about that they explained me they would have to do the trick Ian explained: have the user copy/paste some token. Because that would be an awkward experience, it wasn’t super high on their priority list.

By: Ian McKellar

Ian McKellar — Wed, 09 Jul 2008 20:49:47 +0000

I kicked up a minor fuss when OAuth was being developed over open source applications, and desktop applications in general (since it’s easy to extract secrets from desktop apps - see: http://ianloic.com/2006/12/23/flickr_authentication_security/). It looks like they made the language more stupid before releasing the spec. FAIL. I need to tell those guys off more often.

So, one fairly simple approach is to make users of the web application retrieve a token from the web site when they’ve logged in and put that into the desktop program that will be making requests. Make it something that copies & pastes nicely and only expires when you explicitly expire it or change your password.

By: xxx

xxx — Wed, 09 Jul 2008 13:25:31 +0000

actually, it doesn’t work well on ff 2 either

By: sil

sil — Wed, 09 Jul 2008 13:06:18 +0000

James: yeah, I didn’t bother too much with IE support. I’ve now poked it so comment text isn’t overlain. Still not too bothered about IE support, though.

By: James

James — Wed, 09 Jul 2008 12:51:52 +0000

I’d love to comment, but christ, your comments are a dog’s breakfast, lines a single word long overwriting each other so I can’t read what’s already been said.

By: lefty

lefty — Wed, 09 Jul 2008 12:29:16 +0000

is http://openidenabled.com/files/php-openid/docs/2.0.1/OpenID/tutorial_OpenID.pkg.html helpful?

By: You

You — Wed, 09 Jul 2008 12:08:00 +0000

I think Drupal 6 allows open ID based log ins. (create an account, add an open id to it and then you can use the openid to log in etc etc.

By: sil

sil — Wed, 09 Jul 2008 09:07:59 +0000

Simon: right, OK. Sounds a bit fiddly to set up if all you want is a fairly noddy script rather than a full-on application, but I suppose that’s the way in the new world order.