Controlling Your OpenID Without Running an OpenID Server  

John [userpic]
May 19th, 2008 (08:43 pm) while feeling geeky

One of the benefits to being a livejournal user is that your account is also an OpenID. For instance, if I wanted to log into tanga.com, I could create an account with them, or I could just use my livejournal ID by clicking "Log in with OpenID" and using xpashax.livejournal.com in the OpenID field. This would take me back to livejournal.com, which would (provided I was logged into livejournal, if not it'd log me in first, and) ask me if I want to send my information to tanga.com, I'd say yes and then I'd be in. No need to maintain yet another userid and password. While this might seem a bit convoluted to go through two steps to authenticate rather than just one, but considering you'd have a cookie to keep you logged in, and the fact that you could log into several websites with the same ID, it's actually rather convenient.

The only problem, of course, is what happens when, I don't know, some Russian corporation with connections to the Russian mafia takes over livejournal and you decide you don't want your personal information available to whomever they decide to sell it to, and cancel your account. You've just lost access to all those accounts you had (unless they happen to have a method to convert your account to another OpenID and you had the forsight to make these changes before closing the account). Now you have a problem.

I've come across a solution. Since I have control over john.mort.net, I can use that as my OpenID. Of course, right now the site sits on my Uncle's machine, and he doesn't allow anything other than flat html files to sit there, so I can't run an OpenID authentication server there for now. But there's another option, I can redirect OpenID requests to livejournal by adding the following lines to the <head> of my main index file.

<link rel="openid.server" href="http://www.livejournal.com/openid/server.bml" />
<link rel="openid.delegate" href="http://xpashax.livejournal.com/" />

Now when I want to authenticate to a site that accepts OpenID, I can put in john.mort.net and it will redirect to livejournal to authenticate me. So if later on I decide to kill the livejournal account and want to authenticate to blogspot instead, I would just create a blogspot account and change those lines on john.mort.net to:

<link rel="openid.server" href="http://www.blogger.com/openid-server.g" />
<link rel="openid.delegate" href="http://xpashax.blogspot.com" />

And other than the fact I'm authenticating at blogspot instead, nothing changes in any of my other account where I've been signing in as john.mort.net. Pretty cool!