I don’t have any ideas, why
OpenID not too familiar yet since its first existences in May 2005. As one of authentication protocol,
OpenID purposed to provide a concise way to authenticated user by only entering owned domain name & dropping password field – in usual manner to support single-sign-on – (of course, user need to be self confirmed at first use in any login page). Some said that basic security protocol used by OpenID is too weak. Perhaps, this makes provider such as PayPal, Yahoo, IBM, VeriSign, Facebook & Google enhancing their own process based on its standard protocol just to make the use of OpenID more secure, but this makes OpenID not kind of universal things.
Based on my experience - by continuing
my previous article – with the same topic: Single Account, Multiple Services, here’s my report about generating OpenID on your own domain name – more specific actually - in a Google Apps. You may ignore this article if you have already registering your OpenID in common provider likes ClaimID, MyOpenID, etc, but I’m afraid you’ll lose how to get this things work. And on this current article, I’d covered out.
My experience begun with my curiosity to make my owned domain name as a wide & acceptable OpenID on any login pages that support it. Based on Google API’s, the first thing I need to provide on my www folder was 2 files only;
openid &
host-meta file. Each of it has structures below:
openid files:<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)">
<XRD>
<CanonicalID>abc.com</CanonicalID>
<Service priority="0">
<Type>http://specs.openid.net/auth/2.0/signon</Type>
<URI>https://www.google.com/a/abc.com/o8/ud?be=o8&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.ext1=http%3A%2F%2Fopenid.net%2Fsrv%2Fax%2F1.0&openid.ext1.mode=fetch_request&openid.ext1.type.email=http%3A%2F%2Faxschema.org%2Fcontact%2Femail&openid.ext1.type.country=http%3A%2F%2Faxschema.org%2Fcontact%2Fcountry%2Fhome&openid.ext1.type.language=http%3A%2F%2Faxschema.org%2Fpref%2Flanguage&openid.ext1.type.firstName=http%3A%2F%2Faxschema.org%2FnamePerson%2Ffirst&openid.ext1.type.lastName=http%3A%2F%2Faxschema.org%2FnamePerson%2Flast&openid.ext1.required=email%2Ccountry%2Clanguage%2CfirstName%2ClastName&openid.ns.ext2=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fui%2F1.0&openid.ext2.icon=true</URI>
</Service>
<Service priority="0">
<Type>http://specs.openid.net/auth/2.0/server</Type>
<URI>https://www.google.com/a/abc.com/o8/ud?be=o8&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.ext1=http%3A%2F%2Fopenid.net%2Fsrv%2Fax%2F1.0&openid.ext1.mode=fetch_request&openid.ext1.type.email=http%3A%2F%2Faxschema.org%2Fcontact%2Femail&openid.ext1.type.country=http%3A%2F%2Faxschema.org%2Fcontact%2Fcountry%2Fhome&openid.ext1.type.language=http%3A%2F%2Faxschema.org%2Fpref%2Flanguage&openid.ext1.type.firstName=http%3A%2F%2Faxschema.org%2FnamePerson%2Ffirst&openid.ext1.type.lastName=http%3A%2F%2Faxschema.org%2FnamePerson%2Flast&openid.ext1.required=email%2Ccountry%2Clanguage%2CfirstName%2ClastName&openid.ns.ext2=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fui%2F1.0&openid.ext2.icon=true</URI>
</Service>
</XRD>
</xrds:XRDS>
host-meta files:Link: <https://www.google.com/accounts/o8/site-xrds?hd=abc.com>; rel="describedby http://reltype.google.com/openid/xrd-op"; type="application/xrds+xml"
On both files, don’t forget to replace
abc.com with your domain name then upload it on your www directory. Create a directory named by
.well-known & move
host-meta file in it. As additional, also create (if it doesn’t exist) an index page. In my example, I also copy index.php to index.error.php. You’ll know soon why I created it.
To recognized openid file & adding error 404 forwarder functionality, create (again, if it doesn’t exist)
.htaccess file like example below:
.htaccess files:ErrorDocument 404 /index.error.php
<Files openid>
ForceType application/xrds+xml
</Files>
Now you have the same
www directory structure like mine below:
Until this step, you have succeeded creating your own OpenID named with “abc.com/openid”. Test it to a page, let say a blog page. Make a comment & select OpenID identity.
Enter your OpenID “abc.com/openid”. Here below is my example:
Make a preview & submit. Your comment submitted as “openid” which has link to your domain name.
Unfortunately, now we have 2 problems arise: Why if I clicked that link, my browser continues to download this openid file? And why my identity recognized as “openid”? To solve the first problem, change openid file name on www directory to whatever you like. These changes, continues with replacing “
openid” with new name on
.htaccess file:
ErrorDocument 404 /index.error.php
<Files "what.ever.you.like">
ForceType application/xrds+xml
</Files>
After you changed the name, the structure changes like picture below.
After changed that, try to click again the “openid” link, and tell me what you see? The index page will show replacing downloading file process. This is the reason why we created 404 errors forwarding on .htaccess. Hence, your OpenID also changed from “abc.com/openid” into “abc.com” only. Much simpler, isn’t it?
Anyway, the last problem still unresolved – at least I tried on blogger.com. While I suspect that the blogger OpenID library does not work with Google's (Apps) discovery extensions * is my guess right? *. However, at a time, Google implemented a proof-of-concept implementation of a next-generation OpenID discovery protocol which is it’s not a “full version” yet. Even when it becomes a standard, it is not backwards compatible with the OpenID 2.0 and earlier. Hmm.. see that?
By the way, before you use your OpenID on a different authentication page, why don’t you take a test to
http://www.puffypoodles.com/?. On picture above, I’d tested it just to prove that my OpenID is recognized & acceptable. The test result means that with basic OpenID authentication, it succeeded to retrieve all of possible AX (Attribute eXchange) of OpenID, including email address, home country, preferred language, first name & last name. The conclusion is, the treatment of OpenID yet is different on each authentication since it still in “growing” era going to robustness. Maybe in couple years, a standardize of OpenID will be shaped, to make authentication more secure, private & intimate.
Labels: Google Apps, My Blog Template, My Tricks, Web Programming
If I only have a single IM account, can I make a chat with my friends who have different account on Google Talk, MSN Live, AIM or Yahoo Messenger? For example, if you have name@domain.com & you can chat with friend@yahoo.com or friend@hotmail.com or friend@gmail.com. If you’re on this case, I said: Yes you can! Being have a single IM account will looks more personally than anyone who kept several different of it. Let say, if you had a Yahoo account (eg: name@yahoo.com), then your chat communication is limited to your friends who has the same domain from yahoo.com. It is equal if you have Google account (eg: name@gmail.com) since your friends only comes with the same gmail.com domain. Then, how to make a chat conversation from one account to friends who has different account? Just use a Google account (or any email domain name you want), register it to 
Owning personal domain hosted on a hosting company is one of prestige for some persons. This could be a great benefit to whom aware with that, as they could share their profiles just like personal website or blog or e-commerce online application for examples. Along with existing social networks epoch, ease of communication is one of important thing that can never be separated from web 2.0 trend nowadays. Unfortunately, not all cheap hosting provided SMTP services to manage their outgoing email from client accounts. Especially to newbies programmer who wants to develop an automation email for such of auto email notification or auto responder, this will raise a problem.
