Handling Google OpenID

Question

I'm trying to implement Google OpenID for my website, but I'm struggling to figure out how to handle the OpenID response I get.

At the moment, when you click a login button, it takes you to the Google site, asks you to login there and when i click 'Sign In' it takes me back to my site and I get the followingi n the URL:

http://mysite.com/return.php?openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0          
&openid.mode=id_res          
&openid.op_endpoint=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fud          
&openid.response_nonce=2009-11-07T02%3A50%3A43Zv7QGuR9bs7yijw          
&openid.return_to=http%3A%2F%2Fmysite.com%2Freturn.php          
&openid.assoc_handle=AOQobUfDUg3KHwhcQlAgh4cjISdyflaGuGzWJEpNzR8TnufNIvKLBex4
&openid.signed=op_endpoint%2Cclaimed_id%2Cidentity%2Creturn_to%2Cresponse_nonce%2Cassoc_handle          
&openid.sig=FRIZWu78OrjWgb%2Fkiqq%2B63Zs8Pk%3D
&openid.identity=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawn34aUewQCm4U9DSwJFm4rVyyw9Zi6S_1k
&openid.claimed_id=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawn34aUewQCm4U9DSwJFm4rVyyw9Zi6S_1k

Now i have absolutely no idea what to do with this.

Could someone point me in the right direction please?

Thanks

Answer 1

Use the php-openid library to make OpenID requests and verify the responses from your PHP based website. Rolling your own OpenID is very complicated, and includes complex things like cryptography (eg: Diffie Hellman Key exchange).

The openid specification is an interesting read if you'd like to understand how things work, even if implementing it all would be too tedious. Here are some more developer resources.

To help get you started: In OpenID terminology your website is called a 'relying party' or 'consumer'. Google in this case, would be the 'identity provider' (a service that authenticates users).

There are also specifics using on Google's OpenID implementation online.

But again, I highly recommend using a library.

Answer 2

You might also want to take a look at JanRain's RPX: http://rpxnow.com