Support for Google OpenID

[Venatu]

I am just starting with the library, and am trying to use the
OpenIDLogin control, with an "myad...@gmail.com" ID. However, this
returns an error stating the endpoint could not be found. Is there any
special configuration required?

On a side note, is there a source of documentation for this library? I
could not see any obvious links.

Thanks in advance for any help,
Michael

[Andrew Arnott]

Hi Venatu,

Responses inline...

On Sat, Jul 3, 2010 at 11:07 AM, Venatu <mikel...@googlemail.com> wrote:

I am just starting with the library, and am trying to use the
OpenIDLogin control, with an "myad...@gmail.com" ID. However, this
returns an error stating the endpoint could not be found. Is there any
special configuration required?

myad...@gmail.com is not an OpenID.  So that's why it's not working.  If you want to log in with your Google Account, you need to type in https://www.google.com/accounts/o8/id which is Google's "OP Identifier".

On a side note, is there a source of documentation for this library? I
could not see any obvious links.

Yes.  There is documentation at http://www.dotnetopenauth.net/developers/code-snippets/ and the MSDN-style documentation at http://docs.dotnetopenauth.net/v3.4/

[Venatu]

Thank you for the link to to the MSDN style docs, thats what I was
missing (id found the code snippets and am using them to get started).

I understand what you said about gmail not being an OpenID provider,
as I had found passing reference to this before. However, sites like
StackOverflow (which I believe use this library?) allow you to use
this address to log in. Is this some custom support they have written
to allow this, or is this a feature of the library?

Thanks for the very fast response!
Michael

[Andrew Arnott]

On Sat, Jul 3, 2010 at 12:34 PM, Venatu <mikel...@googlemail.com> wrote:

Thank you for the link to to the MSDN style docs, thats what I was
missing (id found the code snippets and am using them to get started).

You're welcome. 

I understand what you said about gmail not being an OpenID provider,
as I had found passing reference to this before. However, sites like
StackOverflow (which I believe use this library?) allow you to use
this address to log in. Is this some custom support they have written
to allow this, or is this a feature of the library?

Wow.  I hadn't noticed that StackOverflow did that.  They use DotNetOpenAuth as well, so they must be doing some preprocessing on the user-supplied identifier to see if it's an email address that ends with gmail.com and replacing it with Google's OP Identifier behind the scenes.  You can do that too, if you want.  It's amazing that Google doesn't just support it natively (by making gmail.com itself an OP Identifier) like Yahoo has done.

[Peter Watkins]

On Sat, Jul 03, 2010 at 12:34:46PM -0700, Venatu wrote:
> I understand what you said about gmail not being an OpenID provider,

No, not that gmail is not a *provider*, but that an email address is
not an OpenID *identifier*. With the exception of the oddball iNames
stuff (e.g. "=drummond"), OpenID identifiers (what you're expected
to type in the OpenID text box) are http or (preferably!) https URLs.

> as I had found passing reference to this before. However, sites like
> StackOverflow (which I believe use this library?) allow you to use
> this address to log in. Is this some custom support they have written
> to allow this, or is this a feature of the library?

Custom code on their end -- "they must be doing some preprocessing on

the user-supplied identifier to see if it's an email address that ends
with gmail.com and replacing it with Google's OP Identifier behind the

scenes," says Andrew.

I expect that StackOverflow has *not* modified Andrew's code, but merely
added logic to their codebehind. I'm not sure how much -- in order to
prove that you are some...@gmail.com, all SO needs to do is send you to
google and request that your email address be sent along with the
assertion. They appear to do that even if you click the simple Google
button, so they might have only added a simple 2-liner, e.g.

// pseudocode warning: I forget the DNOI/DNOA class/property models for
// this, as I haven't touched this part of my SSO app in months
if ( claimedId.Trim().ToLower().EndsWith("@gmail.com" ) {
// GMail: use the standard Google OP endpoint
claimedId = "https://www.google.com/accounts/o8/id";
}

Also, when I log in by entering my gmail address, SO ends up showing me
This OpenID does not have an account on Stack Overflow yet:
https://www.google.com/accounts/o8/id?id=biglongopaqueidstringhere
so I strongly suspect it's just a 2-line kludge to improve the UX
for GMail users (and, arguably, also muddying the waters for OpenID).
(They might have done something fancy like see that the email attribute
sent them by Google matched the address I originally typed, but as far
as I can tell, it's not that fancy.)

-Peter

[Venatu]

Hmm, Ive been trying to implement it, but am hitting a brick wall. I
have hooked into the LoggingIn event, and am modifying the url, so it
points correctly. However, the validation for the control is stopping
the url input, before the event is fired and I get a chance to change
it!

Is there a way to disable the validation? I have placed:
OpenIdLogin.UriValidatorEnabled = false;
In the Page_Load event. This doesnt seem to be doing anything though,
is this wrong?

Thanks once again,

[Peter Watkins]

Why not put that attribute in the codeahead? I don't know what phase
of page processing the URI validation occurs in, but you want it disabled
all the time, right? So why not specify that in the codeahead?

I don't know what the side effects of disabling validation will be, so
I think you'd be wise to add some code to ensure that the URI looks like
a valid http/https URL or other legal OpenID identifier (e.g., an iName).
You don't want somebody specifying some other registered protocol like "hcp"
and tricking your app into doing something unwanted when it begins the
discovery process.

Alternately, have you tried using client-side Javascript to change
user-provided @gmail.com addresses to Google's URL before the client posts
anything back to your app? That's not what Stack Overflow is doing, but
it might be another, slightly less reliable, way to add that intelligence.

-Peter

[Andrew Arnott]

Peter, "Codeahead"?  I've never heard of that.  I suppose that is the counterpart to the code-behind file. :)

Venatu,

I recommend against disabling validation and trying to write your own.  The validation and auto-normalization in the spec involves several steps and can change based on your site settings as well, so reproducing it would not be trivial.

You're using an OpenID control, such as OpenIDTextBox or OpenIdLogin, right?  That's why you can't do what you're trying to do.  Instead, delete that control tag and just use a standard <asp:TextBox> tag.  Then you'll have a bit more code to write in your code-behind, but then you'll have all the chance in the world to parse the user text for email-like identifiers and do the substitution you need.  

You may find www.dotnetopenauth.net/developers/code-snippets/programmatic-openid-relying-party/ useful documentation when replacing the OpenID ASP.NET control with your own code.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

--
You received this message because you are subscribed to the Google Groups "DotNetOpenAuth" group.
To post to this group, send email to dotnet...@googlegroups.com.
To unsubscribe from this group, send email to dotnetopenid...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/dotnetopenid?hl=en.