# OpenID login to meta?

**URL:** https://meta.discourse.org/t/openid-login-to-meta/16115
**Category:** Site feedback
**Created:** [5월 30, 2014, 4:59오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115 "2014-05-30T16:59:09Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![bulb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bulb/32/31418_2.png) [@bulb](https://meta.discourse.org/u/bulb)
#### Post date: [5월 30, 2014, 4:59오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/1 "2014-05-30T16:59:09Z")

</div>

I thought @codinghorror was big proponent of OpenID. And apparently Discourse does support OpenID. So I am wondering, why couldn’t I create account using my (arbitrary) OpenID URL?

I also tried to log in with GitHub and it didn’t seem to work. Anyway, that wasn’t my preferred way of logging in.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [5월 31, 2014, 12:31오전 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/2 "2014-05-31T00:31:56Z")

</div>

I am a big proponent of _third-party auth._

OpenID was good while it lasted, but **there are better alternatives now with oAuth 2.0** – OpenID made some bad assumptions.

---

<div class="post-metadata">

### Author: ![bulb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bulb/32/31418_2.png) [@bulb](https://meta.discourse.org/u/bulb)
#### Post date: [6월 4, 2014, 7:08오전 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/3 "2014-06-04T07:08:22Z")

</div>

OpenID allows me to identify with an URL of my choice and use a provider of my choice to do the authentication and the site I am identifying myself to does not need to know about provider I want to use in advance. As far as I know oAuth can still only authenticate against predefined providers. Which is _not_ what I want.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [6월 4, 2014, 7:33오전 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/4 "2014-06-04T07:33:09Z")

</div>

The main broken assumption in openid was failure to associate email with user identity. Without email, we have no way to reach users.

---

<div class="post-metadata">

### Author: ![elberet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elberet/32/122404_2.png) [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [6월 4, 2014, 11:34오전 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/5 "2014-06-04T11:34:57Z")

</div>

Sure, because OpenID is an authentication mechanism, not an identity provider. It replaces the password verification, not the signup form.

---

<div class="post-metadata">

### Author: ![bulb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bulb/32/31418_2.png) [@bulb](https://meta.discourse.org/u/bulb)
#### Post date: [6월 4, 2014, 1:19오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/6 "2014-06-04T13:19:03Z")

</div>

> [@codinghorror](#):
>
> failure to associate email with user identity

That’s user’s interest to provide valid email address (and OpenID provides it, it just isn’t verified).

Besides, you can still verify it just like when registering with password and like [bugs.python.org](http://bugs.python.org) did few minutes ago when I registered with OpenID.

> [@elberet](#):
>
> It replaces the password verification, not the signup form.

That’s fine. I _don’t_ want to use account from some other serivce here. I _only_ want to avoid yet another place that I need password for.

---

<div class="post-metadata">

### Author: ![elberet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elberet/32/122404_2.png) [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [6월 4, 2014, 1:52오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/7 "2014-06-04T13:52:02Z")

</div>

Precisely. You create a new local account, activation email and all. The only difference is that you don’t exchange a shared secret (i.e. password) but an authenticated OpenID identifier.

Unfortunately, this is objectively less convenient then signing in through an OAuth2 provider, and convenience trumps all.

Hence WhatsApp has half a billion active users and XMPP/OTR is for paranoid nerds.

---

<div class="post-metadata">

### Author: ![bulb](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bulb/32/31418_2.png) [@bulb](https://meta.discourse.org/u/bulb)
#### Post date: [6월 5, 2014, 3:52오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/8 "2014-06-05T15:52:12Z")

</div>

> [@elberet](#):
>
> objectively less convenient

Convenient and objective don’t go together. There are people who have OpenID and may not have or want to use accounts at the selected oAuth providers and for them OpenID is more convenient. oAuth might be convenient for more people, but that still does not mean OpenID should not be possible.

---

<div class="post-metadata">

### Author: ![elberet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elberet/32/122404_2.png) [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [6월 5, 2014, 4:42오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/9 "2014-06-05T16:42:38Z")

</div>

My point was that given the choice, Google OAuth2 is minimally more convenient then OpenID. But yes, sure, if the app doesn’t support any OAuth providers known to you, then OpenID is more convenient in the same way riding a bike is more convenient then getting a cab when the zombie apocalypse has killed all cab drivers.

Anyway, weird comparisions aside, I fully agree with you that OpenID authentication would be very nice to have. I guess the sarcasm in my previous post was a bit too subtle. 😉

---

<div class="post-metadata">

### Author: ![strk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/strk/32/121193_2.png) [@strk](https://meta.discourse.org/u/strk)
#### Post date: [9월 2, 2016, 11:35오전 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/10 "2016-09-02T11:35:41Z")

</div>

I’m also missing the possibility to login via OpenID from any Discourse installation I found out there. Is it supported at all ?

---

<div class="post-metadata">

### Author: ![strk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/strk/32/121193_2.png) [@strk](https://meta.discourse.org/u/strk)
#### Post date: [3월 10, 2017, 6:14오후 UTC](https://meta.discourse.org/t/openid-login-to-meta/16115/11 "2017-03-10T18:14:31Z")

</div>

For what is worth, chances are that implementing dynamic-client-registration for OpenID Connect would give users the same freedom as OpenID-2.0 (authenticating self via an arbitrary URL).  
To be confirmed: [Final: OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-registration-1_0.html)

Please help keeping the Internet a decentralized place 🙂
