So I finally jiggered the OpenID installation into place and it's working pretty well. I figure I will detail some of the gotchas I ran into.
- There are more than three states/steps to the OpenID sign-in process. This is confusing, because the documentation and sample code would lead you to believe that there are three. There are, in some cases, up to seven. Watch your server logs and see how many times a SERVER and USER (the ones requesting the authentication) hit the PROVIDER (what you are presumably setting up.) It's difficult to debug something when you're only looking at half of the interactions
- Many providers are using the unfinalized OpenID 2.0 spec. (It's a little better.) The 2.0 spec performs differently from the 1.0 spec; the SERVER (them) establishes trust with the PROVIDER (you). Net::OpenID::Server handles this gracefully, but doesn't tell you what spec it's using. The 2.0 spec adds a step to the handshaking process.
- Set up your own OpenID SERVER for easy testing. I used a simple Rails server with a gem called ruby-openid. It took about 10 minutes to set up to mimic behavior of a real in-the-wild server.
- It should go without saying, but make sure your login process is stateless. We had a global variable that handled how the user was verified. Because use of that variable made certain assumptions that were incompatible with the OpenID sign-in process, users would have been allowed to log in to accounts other than their own. This is obviously bad. A few closures and we have some stateless and more secure code.
All in all, OpenID is pretty cool once you get it working.