#open id

To many, it sounded like a good idea when Apple announced its Sign In with Apple service at WWDC 2019 last month: a privacy-focused login feature that will let macOS Catalina and iOS 13 users sign into third-party apps and websites using their Apple IDs.

It’s a service that’s designed to rival those of the data-gobbling behemoths, Google, Twitter and Facebook, each of which have their own no-no-how-about-you-sign-in-with-ME authentication services. All of these services allow you to use your ID for a quick, one-click sign up or sign on, no password required, as long as you’re signed into whatever tech bigwig’s service that you’re using.

The following tutorial will show you how to enable your web application for Open ID to let your users log in without having to remember yet another password.

1. Get your Open ID

The first step is to have an Open ID to use to test your sign-on. If you already have an Open ID or are signed up for a site that gives you one, then you are all set. Otherwise, sign up at a provider such aswww.myopenid.com and get your own Open ID URL.

2. Download the PHP class

We will use a PHP class in order to simplify the process of communicating with the Open ID provider. The class we are going to use is the Simple Open ID Class that is available fromwww.phpclasses.org/browse/package/3290.html. The version of the class we have used is available in the code sample, however, if you are going to use this in a live application, check the site for any updates to it. In the zip that you have downloaded, the file you will need is class.openid.v2.php. Save this into your site, naming it anything you like.

3. Create a form

In a new PHP file, add a form; all we need is a field for the user to enter their Open ID URL and a Submit button. Set the form to post back to itself for this example. We’ve also added a link to myopenid.com so the user can go and get an Open ID if they don’t have one yet.

<form action=”index.php” method=”post”>

<h1>Login with your openID</h1>

<div>

<div><label for=”openid”>Your OpenID</label><input

ype=”text” name=”openid_url” id=”openid” class=”text” />

<input type=”submit” name=”login” value=”Login” class=”btn”

/></div>

<p><a href=”http://www.myopenid.com/”>Get an OpenID</a></p>

</div>

</form>

4. Posting the form

We now need to deal with what happens when the user posts the form containing their Open ID. At the very top of this script inside PHP tags, include the class we downloaded earlier and create a new instance of that class.

require(‘class.openid.v2.php’);

if ($_POST) {

$openid = new OpenIDService();

5. Set up the request

In addition to checking whether the user is valid, we can ask the Open ID server to send us back some information about the user, such as their email address, full name and gender. The user needs to have already entered this information into their profile and agree to send it to you when they get to the Open ID site. The following lines of code set the user’s identity (this is the URL they entered into the text box), the site that is asking to be authorised, some required fields that we need and some optional fields.

$openid->SetIdentity($_POST[‘Open ID_url’]);

$openid->SetTrustRoot(‘http://’ . $_SERVER[“HTTP_HOST”]);

$openid->SetRequiredFields(array(‘email’,’fullname’));

$openid->SetOptionalFields(array(‘dob’,’gender’,’country’));

6. Redirect to the Open ID provider

We redirect out to the provider setting, the URL that we want the user to be brought back to after completing their sign-on process. In our case, that is this same script we are posting out from but you might also have a different script to handle logins in a full application. If anything goes wrong at this stage, just write out the error information to variables so we can see what happens.

if ($Open ID->GetOpenIDServer()){

$openid->SetApprovedURL(‘http://’ . $_SERVER[“HTTP_

HOST”] . $_SERVER[“PATH_INFO”]);

$openid->Redirect();

}else{

$error = $openid->GetError();

$error_code = $error[‘code’] ;

$error_string = $error[‘description’];

}

}

7. Testing the redirect

You should now be able to enter your Open ID into your form and be taken to the Open ID server to perform the login. After logging in, the server will let you decide whether to authorise this site once, always or cancel the request. We can also choose what information we send back to this site.

8. After login

If you allow the authorisation on the Open ID server, you should find yourself back at your script. In the address, there will be a query string containing information sent back from the Open ID server. This information will inform us whether the login was successful and if it gives us some information about the user.

9. Checking for successful authentication

The below code goes after the closing bracket of the if statement, checking to see if we have a Post. It runs when the user is redirected back from the Open ID server. If we have the parameter openid_mode in our Get, then we check to see if it has a value of id_res. This means that we have an authentication. The first thing to do is to create a new instance of the Open ID object to check that this really is a valid user and not just someone forming a correct query string to try and log into our site. We do this using the ValidateWithServer method, which will return true or false. Put that value into a variable to check.

elseif($_GET[‘openid_mode’] == ‘id_res’){

$showform = false;

$openid = new OpenIDService();

$openid->SetIdentity($_GET[‘openid_identity’]);

$openid_validation_result = $openid->ValidateWithServer();

10. A valid login

If our variable $openid_validation_result is equal to true, then we have a valid login – hooray! Now we can do whatever we want to do with the information we get back from the server. In our case, we are just going to get the details from the Get and write them out into variables. If you were integrating Open ID into your site authentication, you would now insert this information into your database and continue exactly as if you had authorised using a username and password on your own site – except that you don’t need to worry about storing passwords. We are setting a variable named ‘status’ to VALID so that we can check this later on our page when we display the result of the authentication.

if ($openid_validation_result == true) {

//get the users details from the GET

$country = $_GET[openid_sreg_country];

$dob = $_GET[openid_sreg_dob];

$email = $_GET[openid_sreg_email];

$fullname = $_GET[openid_sreg_fullname];

$gender = $_GET[openid_sreg_gender];

$identity = $openid->GetIdentity();

$error_code = ‘’;

$error_string = ‘’;

$status = ‘VALID’;

}

11. Dealing with errors

We need to deal with any errors that might occur, such as an invalid authorisation or some error generated by the server. If we write these to variables, we can find out what happened. In a live site, you need to make sure your user knows what to do if the error is caused by an incorrect login. You might also want to log errors to a database table or text file so you can see if anything is happening often. If the error has been caught by the object, then it can be retrieved with the GetError() method that returns an array.

elseif($openid->IsError() == true){

$error = $openid->GetError();

$error_code = $error[‘code’];

$error_string = $error[‘description’];

$status = ‘ERROR’;

}else{

$error_code = ‘’;

$error_string = ‘INVALID AUTHORIZATION’;

$status = ‘INVALID’;

}

12. User cancelled request

If you deny the authorisation on the Open ID server, then the value of openid_mode will be ‘cancel’. In this situation, the user has cancelled the request and so you cannot then log in. You would need to give the user some information in this situation, perhaps giving them contact details if they have concerns about the information that you want to access.

else if ($_GET[‘openid_mode’] == ‘cancel’){

$showform = false;

$error_string = ‘USER CANCELLED REQUEST’;

$error_code = ‘’;

$status = ‘CANCELLED’;

}

13. Showing the information

For the purposes of this article, we will just display the information that has been returned – or the error message generated – so you can see that the login has worked. At the top of your script (just below the include of the class), add $showform = true;. Then wrap the form in your page with an if statement checking for $showform.

<?php

if($showform) {

?>

<form action=”index.php” method=”post”>

<h1>Login with your Openid</h1>

<div>

<div><label for=”openid”>Your OpenID</label><input

type=”text” name=”openid_url” id=”openid” class=”text” />

<input type=”submit” name=”login” value=”Login” class=”btn” /></div>

<p><a href=”http://www.myopenid.com/”>Get an OpenID</a></p>

</div>

</form>

<?php

}

?>

14. Display the returned information

If our status variable is set to Valid, then we have the user details. Echo them out to the page as proof of the successful authentication.

15. Error display

The following code will print out the error messages that have been received. These messages are more for debug purposes, so don’t forget to display more friendly and helpful error messages to your users, in case they are having problems logging in.

elseif ($status == ‘INVALID’) {

echo ‘<h1>Sorry, we could not log you in</h1>’;

echo ‘<p>’. $error_code .’: ‘.$error_string .’</p>’;

} elseif ($status == ‘CANCELLED’) {

echo ‘<h1>Sorry, we could not log you in</h1>’;

echo ‘<p>’.$error_string .’</p>’;

}

}

  “The OpenID Foundation is warning users about a weakness in the software that could [0]enable an attacker to change some of the data exchanged between parties that use OpenID.

The group is telling sites that implement OpenID to [1]update to a new version in order to fix the problem. The bug in OpenID lies in the system’s Attribute Exchange, an extension that gives sites the ability to exchange identity information between endpoints.

OpenID, an open source project that enables users to prove their identity to myriad sites without providing their passwords, is used by a slew of popular sites, including Google, Yahoo and Flickr.”

Discuss this story at: https://it.slashdot.org/story/11/05/07/0441244/OpenID-Warns-of-Serious-Remote-Bug-Urges-Upgrade?utm_source=newsletter&utm_medium=email#commentlisting

Facebook unleashed a new commenting system last week that promises to help online publications clean up their commenting cesspools, while simultaneously extending Facebook's tentacles further into the web outside its walls.  Unfortunately for those with visions of a non-Facebook dominated web, this initiative has the potential to dramatically expand the ginormous social network's already imperial reach.

The new system lets website owners replace their current commenting system with Facebook's simply by dropping in a few lines of Javascript.

Then, commenters have to sign in using either their Facebook or Yahoo IDs, an attempt to ensure a commenter is a real person. Commenters can opt to have their comment posted as an update, along with a link to the original story, which spreads the story link inside Facebook's walls.This offers publishers a number of benefits. They get more links to their site from inside the net's most popular website. A lot of people are "registered" to comment on their sites. And, they have a system designed to discourage vitriol because it's easy for the site owner to ban a user and tough for a user to create a new identity.For Facebook, the benefit is also clear. Users now have even more incentive to be constantly logged into Facebook (those who are already logged into Facebook don't have to do anything to comment on a website using its system)Additionally, even more of Facebook's users' net activities flow through its site, since by default comments -- and replies to them -- post to a Facebook user's wall. That deepens users' ties to Facebook, adds more content to Facebook, and gives people more reason to check their Facebook newsfeed for the increased information flow.It also builds on what's becoming Facebook's most important function: being the identity provider and validator for the wider net. The system opens the door for what's likely inevitable: having news sites rely on Facebook to identify its users and eventually to serve ads to its readers based on their individual Facebook pages.The Facebook system competes most directly with Disqus (a system Wired.com has just starting using), which also creates a single, central profile used to comment on any site that uses the system. Facebook offers its plug-in for free, while Disqus commenting requires premium accounts for the features a large site needs to have.The immediate drawbacks of Facebook's commenting system match the larger issues of the social networking site. There's no way to export the comments if a publication decides to drop the system -- just as Facebook jealously holds onto the e-mail addresses of the people you are connected to on Facebook so you can't re-establish your network on some other site.Facebook will likely create some sort of export system, if only to assuage potential publications, though given Facebook's history with exporting, it will likely be bare bones and not particularly useful in practice.Facebook's entry into this arena presents sites with three choices -- none particularly ideal.The first is to gamble that your site is important enough to your readers that you can get away with requiring them to have a specific login for your site, and that you have the technical resources to build that out. But even if you don't use Facebook Connect, the movement seems to be away from a collection of site profiles and passwords and toward a single one that gives you entry to your collection, be it from Google, Yahoo, OpenID or others.The second option is to go with a service like Disqus and pay that company annually to uphold the belief that there should be multiple identity providers on the net and hope they have enough staying power and stickiness to appeal to your readers.Or, you can go with Facebook, tacitly acknowledging that the world's largest social network has won the identity wars and getting in on the spoils without paying an annual fee and agreeing to be an occupied outpost in Facebook's empire.Online publications are desperate for a commenting system that encourages civility, and too many, including Disqus, veer closer to the land of YouTube comments than to the ideal of comments on sites like MetaFilter and Hacker News.Sites that can afford to do so will likely continue to have their own login systems, if only so that they can collect e-mail addresses, which are still considered incredibly important for marketing and for "owning" a customer.

But doing so leaves a site open to the bad PR of being hacked (like Gawker Media) and without work by either the site or the software maker they use to publish, they will fall behind on the benefits of a social web.

tumblr è perfetto così com'è. non ha bisogno di modifiche: questo è assodato.  ma stanotte non riesco a dormire, non ho voglia di preparare la valigia, in tv c'è solo una replica di talent1, i telecomandi della wii sono scarichi e di cercare un dvd da guardare non se ne parla.. così ho webtrotterellato selezionado qualche applicazione che permettesse di aggiungere i commenti su tumblr. per il primo test giocherò con Intense Debate .. successivamente valuterò anche Disqus .. così al prossimo che si chiede quale strumento utilizzare su tumblr affinchè ci siano i commenti potrò fornire la mia risposta ponderata e non improvvisata. detto questo, vi è un problema, ahimè, annoso. come da incipit, tumblr è perfetto.. ha senso dargli la possibilità di commentare i micropost? e soprattutto, voglio che i post siano commentati? alla fine, c'è friendfeed se proprio vogliamo cercare la conversazione.. domanda obbligatoria: sto cercando la conversazione?  la risposta, nuovamente ahimè, è scontata. no. per lo meno, non qui. altrove sì, ovvio. c'è twitter, ci sono altri blog.. se c'è una cosa che non manca online sono gli spazi, anche se poi, inevitabilmente, tutto si riassume in un condominio di medie dimensioni. penzu non mi basta e tumblr è più flessibile ed adatto ad una persona pigra come me.

è ora di concludere. li mettiamo o no questi commenti su tumblr? io direi di no. e con il test per i commenti? quello lo porto avanti, è ovvio. trenta giorni in totale. dieci a Debate, dieci a Disqus e gli altri dieci per vedere se magari c'è qualcosaltro in giro nella rete di pigramente interessante.