You very own OpenID server! What's it running?

synthead · 2012-08-29 15:24:14

I'm looking into setting up my own OpenID server, and am pleasantly surprised to see so many options across so many languages! So this leads me to having to ask: what do you use any why? Any security advice you can give about it? Possible exploits?

Mod-edit: thread re-opened based on this clarification of the question

My concern is old code. There was a vulnerability found on March 2012, for example; see here: http://en.wikipedia.org/wiki/OpenID#Authentication_bugs
OpenID suggests a few projects here: http://wiki.openid.net/w/page/12995226/ … y%20server
If we think in the scope of what the wiki suggests, here's what's available (and the last modification dates to the code):
Community ID, Feb 17, 2010: http://sourceforge.net/projects/communityid/ (author's website is offline)
Prairie, September 22, 2008: http://barnraiser.org/prairie
phpMyID, July 23, 2008: http://siege.org/phpmyid.php (author declared the project dead)
Janrain php-openid, seems to be recent: http://janrain.com/openid-enabled/
Clamshell, August 1, 2008: http://wiki.guruj.net/Clamshell!Home
InfoGrid id-lid, looks current, but looks like an API more than a server/service: http://infogrid.org/trac/wiki/Projects/ig-lid
SimpleID, January 26, 2012: http://simpleid.sourceforge.net/
As I'm sure you gathered, many of these projects are years out-of-date. For a server/service that will help me log into accounts, I do not want to fall to security vulnerabilities (we're talking identity theft, here), and I've only found one or two out there that could meet my needs.

Last edited by ngoonee (2012-08-30 05:16:14)

ngoonee · 2012-08-30 00:20:14

Come on synthead, you've been around long enough to know that such open-ended questions lead nowhere.... Dustbinned for deletion.

EDIT: reopening on synthead's request and direct clarification.

Last edited by ngoonee (2012-08-30 05:13:58)

synthead · 2012-08-30 05:19:27

ngoonee wrote:

Come on synthead, you've been around long enough to know that such open-ended questions lead nowhere.... Dustbinned for deletion.
EDIT: reopening on synthead's request and direct clarification.

Thanks a lot, I really appreciate that I should have been more descriptive in my post.

So I decided to try SimpleID on my webserver, and when trying to use it to log into Stack Overflow, I get this (please note: censored URL):

Stack Overflow wrote:

Unable to log in with your OpenID provider:
The OpenID Provider issued an assertion for an Identifier whose discovery information did not match. Assertion endpoint info: ClaimedIdentifier: https://-censored- ProviderLocalIdentifier: https://-censored- ProviderEndpoint: https://-censored OpenID version: 2.0 Service Type URIs: Discovered endpoint info: [{ ClaimedIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderLocalIdentifier: http://specs.openid.net/auth/2.0/identifier_select ProviderEndpoint: https://-censored- OpenID version: 2.0 Service Type URIs: http://specs.openid.net/auth/2.0/server http://simpleid.sourceforge.net/type/version#0.8.1 http://specs.openid.net/extensions/ui/1.0/mode/popup http://specs.openid.net/extensions/ui/1.0/icon },]

Other services also throw errors, but nothing as descriptive as SO's. What could be the matter here?

Last edited by synthead (2012-08-30 05:21:28)

synthead · 2012-08-30 05:39:39

Found this interesting: http://www.untrusted.ca/cache/openid.html

Arch Linux

#1 2012-08-29 15:24:14

You very own OpenID server! What's it running?

#2 2012-08-30 00:20:14

Re: You very own OpenID server! What's it running?

#3 2012-08-30 05:19:27

Re: You very own OpenID server! What's it running?

#4 2012-08-30 05:39:39

Re: You very own OpenID server! What's it running?

Board footer