can I change my open ID URL change?

Question

I wanted to know if I can change my open ID url from say:

www.abc.com/username

to

www.pqr.com/username

while the relying party still thinks I am the same user?

or even say:

www.abc.com/something/username

to

www.abc.com/somethingelse/username

I intuitively think that this is not possible since if it were, then it is possible for anyone to spoof anyone else's identity.

Also, does Open ID specify which fields the relying party should use to ensure secure determination of the user's identity? For example, I would expect it to club the URL provided with the username/email address sent back by the Open ID server.

Answer 1

This answer assumes that you are trying to login using two different URLs that have redirects to the same OpenID page.

I do not know if it is possible to use two different URLs for the same login because I am not sure what uniquely identifiable information OpenID relays. Stack Overflow does not currently allow this: different URLs pointing to the same OpenID portal will authenticate differently.

Assuming OpenID sends unique information for each account and not just each URL, it should be possible to swap the URLs without losing any security.

This would not pose a security risk because the same OpenID portal would still perform the authentication, requiring the correct user to login. The OpenID delegation you would use on these pages just redirects to the proper OpenID authentication portal:

<link rel="openid.server" href="http://www.myopenid.com/server" /> 
<link rel="openid.delegate" href="http://YOUROPENID.myopenid.com/" /> 

Obviously all security is lost if you identify your account using an OpenID URL for a page that you do not have complete control over.