views:

628

answers:

1

When I play ping-pong with the Google OpenID provider, I can't get a friendly name/nickname/username (whatever you want to call it).

I get something atrocious looking like the following:

www.google.com/accounts/o8/id?id=AItOawmtAnQvSXGhRTkAHZWyxi4L4EKa7xoTT1dk

instead of something nice like

JohnDoe

What's the protocol for getting the user's name from Google in a nice friendly manner like say, myopenid does?

*I'm using DotNetOpenAuth

+6  A: 

You can't. The identifier that the OP issues is strictly up to the OP. The RP doesn't really have any say in it. Now, some OPs support offering attributes with the login, such as nickname, email address, etc. Google has very limited support for these, offering only email address.

Google chose to not issue user-recognizable identifiers because it's an information disclosure risk. Yahoo went both routes by offering users both a human-friendly and non-human-friendly identifiers that the user can choose between. MyOpenID and other OPs generally go with just a user-friendly identifier that the user picks when they sign up at the OP.

You may want to special case Google at your RP to pick a more friendly string to display to the user when they're logged in, or since Google isn't the only one that does this, write code to figure out when the identifier is unreadable and display something more friendly to the user so they know they're logged in (perhaps their email address or a nickname they pick on your site).

Caution: if you choose to display a more friendly identifier than the one Google issues, you must still use the official Claimed Identifier from Google for the official username of the user that you pass to FormsAuthentication.RedirectFromLogin and for username lookup in your database. Anything else you put together usually introduces security risks.

Andrew Arnott
Thanks for clearing this up. I guess using a default friendly identifier as the user's email can work. Would you happen to know which other services don't play nice with regards to friendly names?
MunkiPhD
Yahoo is the only other one I know of, and it only has this behavior sometimes.
Andrew Arnott
Andrew, I managed to get deeper into your blog posts and found the one with regards to Yahoo. I'll have to read it again to fully comprehend it - but in my unknowing trials I could not even get an email address back from Yahoo, which befuddles me as I use a Yahoo login for stackoverflow - and my information clearly transferred over...
MunkiPhD