[Rails] [ANN] Ruby OpenID library and OpenIDLoginGenerator

Brian Ellin
Thu, 05 Jan 2006 23:18:02 -0000

Steve,

On 1/5/06, Steve Sloan <steve@finagle.org> wrote:
>
>
> That''s very cool, and similar to a single-sign-on schema I was
> contemplating.
>    This might just let me do away with user authentication all together,
> or at
> least move it to my own identity server.  Anybody work on a Rails identity
> server? :)


A server library is in the works, but won''t be available for some time.
I''ll ping the list when it''s ready.


Before I take the plunge, though, I''m wondering how useful OpenID would
be
> for
> preventing phishing attacks.  I know that the point is to identify the end
> user to a third-party website, but what provision does the protocol offer
> to
> the identity server for verifying that the website is who it claims to be
> (or,
> at least, who it claimed to be when you first logged in to it).
>
> In other words, if I tell my identity server to always trust foobar.com,
> what
> assurance do I have that I''m actually being authenticated by
foobar.com
> ?  Are
> there persistent shared secrets between the website and the identity
> server?
> And, as a website operator, what happens if those secrets are lost?


Persistent shared secrets are stored on the site "consuming" the
identities.  If for some reason the shared secret is lost, a new shared
secret must be created.  This exchange is part of the OpenID protocol and
covered in the "associate" step:

http://www.openid.net/specs.bml#mode-associate

The OpenID library will automatically use an existing association with a
server if it exists, otherwise it will perform the associate step and store
the secret for future requests.

Hope this helps,
Brian Ellin
-------------- next part --------------
An HTML attachment was scrubbed...