OpenID Wiki - OpenIDFAQ

(This list is modeled after the WebDAV FAQ)

Please be BOLD and modify this page with detailed answers and new questions!

OpenID features and benefits

How does OpenID relate to yadis?
How does OpenID relate to LID?
What are the goals of OpenID?
What are the major features and benefits for users and for developers?
Which features are complete, and which are still being defined?
Where can I read a detailed description of the versioning goals, model, and proposed protocol?

What OpenID is NOT

What about profile exchange?
What about trust?

More about OpenID

Is OpenID open, or is it some kind of proprietary standard?
Who creates and controls future directions of OpenID?
How can I help and participate in the evolution of OpenID?
How does OpenID relate to the OASIS Extensible Resource Identifier (XRI) TC?
Why not using the "user @ host" format, since it is an identity?

OpenID software

Consumer implementations
Server implementations

Technical questions

How secure is OpenID?
What are the benefits and contraints of "dumb mode" and "smart mode"?
Can I use OpenID over HTTPS, FTP, or another protocol?

OpenID resources

Where can I get additional information about OpenID? Are there discussion groups, mailing lists, or newsgroups that I can participate in?
How can I help promote OpenID?
Who are the OpenID adopters?

OpenID features and benefits

How does OpenID relate to Yadis?

The Yadis 1.0 specification was released in February 2006. Yadis is a discovery protocol for what URLs can do. For example, Yadis can be used to find out that a given URL supports the OpenID protocol, and many other kinds of protocols.

For more information about Yadis, please refer to the Yadis FAQ.

Confusingly, yadis was also the draft name used for OpenID during its design stage. It originally stood for "yet another distributed identity system". When the openid.net domain name was offered, it was decided to keep this new name.

Note that the mailing list name for both OpenID and Yadis is still yadis.

How does OpenID relate to LID?

Light-Weight Identity (LID) is a modular architecture for simple identity technologies pioneered by NetMesh. It supports features such as single-sign-on, profile exchange, authenticated messaging, sessions and others.

Since the originators of OpenID and LID have been cooperating around Yadis, both now share a common discovery protocol; OpenID is also one of the several methods for single-sign-on supported by LID.

For more information about LID, you are advised to refer to the LID Website.

What are the goals of OpenID?

Define a decentralized identity system that nobody owns.
Allow use of a sole identity on multiple websites
Remove the need to transmit user credentials everytime an identity is used

What are the major features and benefits for users and for developers?

From a user's standpoint

-elaborate-

Single Sign On (SSO) - Less annoying login pages, "one sign-on to rule them all"
Me is Me - the OpenID identity is a gateway for more information about me: profile, friends, contact, etc.

From a web developer's standpoint

-elaborate-

Benefit from a large user base without managing the hassle of passwords.

Which features are complete, and which are still being defined?

The first version of the OpenID specifications have reached a stable state.

The protocol version is now 1.1. The reference implementation is Brad's Perl libraries (see the OpenID software section.)

You may consult the specs at the OpenID website OpenID specs and on the Wiki (OpenID lower-level specs).

Where can I read a detailed description of the versioning goals, model, and proposed protocol?

-elaborate-

The protocol uses HMAC and Diffie-Hellman encryption. OpenID lower-level specs

What OpenID is NOT

What about profile exchange?

-rewrite this-

Scour the FOAF/XFN/vCard/hCard, etc. OpenID explicitly leaves that issue to another layer. OpenID only verifies you own a URL. Look at this project for profile exchange: http://xprofile.berlios.de/

What about trust?

-stub-

More about OpenID

Is OpenID open, or is it some kind of proprietary standard?

-stub-

Who creates and controls future directions of OpenID?

-stub-

How can I help and participate in the evolution of OpenID?

-stub-

How does OpenID relate to the OASIS Extensible Resource Identifier (XRI) TC?

-stub-

Why not using the "user @ host" format, since it is an identity?

The LID FAQ provides a reasonable answer for this. Furthermore, there is currently no standard way of mapping a email-form identity to a URL, which is problematic because OpenID works on HTTP. As pointed out in the LID FAQ, unless a de-facto standard emerges, there would also be no easy way to retrieve information about a given identity as simple and as easily extensible as in HTTP.

OpenID software

Here are code libraries for implementing OpenID.

Consumer implementations

Perl: Net::OpenID::Consumer [Brad's reference implementation; GNU GPL or Artistic License]
Perl: NetMesh InfoGrid LID Perl (Sleepycat open-source license or commercial)
Java: IDPrism [Apache License v2.0]
Java: NetMesh InfoGrid LID Java (Sleepycat open-source license or commercial)
Ruby: http://intertwingly.net/stories/2005/10/11/ [using the Ruby on Rails framework; unknown license]
Python: http://openid.schtuff.com [GNU LGPL]
PHP: PHP-OpenID [port from Python; GNU LGPL]
PHP: NetMesh InfoGrid LID PHP (Sleepycat open-source license or commercial)
C++: libopkele [MIT License]

Server implementations

Perl: Net::OpenID::Server [Brad's reference implementation; GNU GPL or Artistic License]
Perl: NetMesh InfoGrid LID Perl (Sleepycat open-source license or commercial)
Java: IDPrism [Apache License v2.0]
Java: NetMesh InfoGrid LID Java (Sleepycat open-source license or commercial)
Ruby: http://intertwingly.net/stories/2005/10/11/ [using the Ruby on Rails framework; unknown license]
Python: http://openid.schtuff.com [GNU LGPL]
PHP: PHP-OpenID [port from Python; GNU LGPL]
PHP: http://www.livejournal.com/users/taral/147710.html?thread=542974 [scroll for tarball link; AS-IS? copyleft license]
PHP: NetMesh InfoGrid LID PHP (Sleepycat open-source license or commercial)
C++: libopkele [MIT License]