OpenID provider library recommendations for PHP

Question

Our PHP site uses a home-grown forms auth implementation. We're considering making our site into an OpenID provider so that we can authenticate (using our exisitng user accounts) users on a StackExchange site. If we have to add code or UI to our login form or add fields to our database, that's fine-- we just don't want to have to rip out what we have and replace it all in order to get OpenID provider support.

There are several libraries for PHP linked on the OpenID website. Anyone have experience with using any of these libraries to adding OpenID provider capability to a PHP site, and if so which is your favorite and why? Are there particular libraries you would stay away from, and if so, why?

Answer 1

Start with browsing through the official OpenID developer website @ http://openid.net/add-openid/become-a-provider/

There, it gives you three options:

• Outsource to a third-party provider
• Use an existing library or plugin
• Read the specs and OpenID yourself

Option 1 may not be the one you would aiming for, since you want your site to be a provider as you have hinted above.

Option 3 is ok if you have the time and capacity to implement it. Try going through http://openid.net/specs/openid-authentication-2_0.html and see if your development team can stomach that.

Finally, there's option 2, which I think the best choice. There are enough choices of PHP libraries listed in http://openid.net/developers/libraries/#php . I imagine it would be easy to use one of these libraries to extend your existing authentication mechanism to provide OpenID authentication service but I can't be sure as I have not tried any of them yet.

Good luck and godspeed!

Answer 2

Well, most of the options listed on that page don't have provider support, so I think your options come down to OpenID Enabled's php-openid or Zend_OpenId. I'm partial to the openidenabled libraries myself, but then again, I was on the team that wrote them. php-openid is generally compatible with a wider range of PHP versions, and its test coverage is pretty extensive.

I don't really know much about the Zend offering, but it might be appropriate if you're fortunate enough to not need PHP 4 compatibility and like that framework thing they do.