5

I want to become my own OpenID provider.

I need it primarily for logging into sites using OpenID 2.0. For older sites, support of OpenID 1.1 would be great. I don’t know much about the new OpenID Connect, so I’ll leave that open.

I would prefer if only one user is supported (there’s a question for a multi-user OpenID provider), in the hope that it’s more lightweight (which would make it easier to audit the software, should the need arise), that it gives less attack surface, and that it works without a database.

Formal requirements

  • It must be licensed under a FLOSS license.
  • It must still be maintained.
  • It must run on a GNU/Linux server.

What I found

  • phpMyID is "no longer developed or maintained".

  • Prairie seems to be dead (according to the filename of the current version 0.2 Alpha, it is from 2008).

  • OleKEH’s prairie-openid2-server (started as a fork of Prairie) seems to be dead (last code change from 2011).

  • poit seems to be dead (last release from 2009).

  • SimpleID sounds good (although it supports multiple users; but at least it’s not using a database) and doesn’t seem to be dead (last release from 2014-11; last site activity from 2015-04).

    (I will try this one unless I get other recommendations; of course, feel free to come up with an answer if you can recommend SimpleID for my purpose.)

Improve this question
6
  • What's the difference to softwarerecs.stackexchange.com/questions/21105/… ?
    – Frederick Nord
    Sep 30, 2015 at 8:44
  • @FrederickNord: As I wrote, I’ll accept and prefer solutions for only one user, while OP of the linked question looks for multi-user solutions.
    – unor
    Sep 30, 2015 at 13:31
  • @Tom: (As you seem to have created the self-hosted tag -- did you see the Meta discussion Tags for software that runs on a (web?) server? If not, maybe you want to chime in.)
    – unor
    Oct 1, 2015 at 23:43
  • @unor I did and viewed your answer, is this not the best way to go about this?
    – Tom
    Oct 2, 2015 at 3:44
  • @Tom: Okay, alright; I thought maybe you have a suggestion for improvement or a different idea or something like that. (I guess a score of +4/0 is not quite enough for starting such a big retagging event.)
    – unor
    Oct 2, 2015 at 3:48

1 Answer 1

Reset to default
1

For my own site, I used what basically amounts to OpenID forwarding. My site is built using ikiwiki so I use the meta directive to add an OpenID delegation to another domain. This ends up creating the following HTML code in the header:

<link href="https://login.launchpad.net/+openid" rel="openid.server" />
<link href="https://login.launchpad.net/+openid" rel="openid2.provider" />
<link href="https://login.launchpad.net/+id/xxxxxxx" rel="openid.delegate" />
<link href="https://login.launchpad.net/+id/xxxxxxx" rel="openid2.local_id" />
<meta http-equiv="X-XRDS-Location" content="https://login.launchpad.net/+id/xxxxxxx/+xrds" />

So you can see here I delegate to Canonical's Launchpad but I could also have used any other OpenID provider I have an account on, including Stack Exchange:

<!-- OpenID-2.0 delegated to stackexchange -->
<link rel="openid2.provider" href="https://openid.stackexchange.com/openid/provider" />
<link rel="openid2.local_id" href="https://openid.stackexchange.com/user/xxx-xxx-xxx-xxx-xxx" />

The Indieweb folks have an excellent tutorial on how to do this forwarding. There are also Wordpress, Drupal and probably other plugins that do this for you. But honestly, considering how simple the HTML code is, I would argue that it may be simpler to just have a static HTML page pointing to another provider than using a plugin.

I have looked at running my own OpenID provider as well, lightweight, without a database and all that. I ended up cheating like this: seems much simpler. After Google and even free software projects (e.g. Drupal 8) basically abandoned OpenID, I wasn't sure about the future of OpenID so I didn't want to spend too much efforts on it.

I know OpenID delegation isn't exactly like running your own provider, but considering that you didn't want to run a database and this is single user, I feel that just running a virtual host with a static page basically amounts to the same thing. You still need to run a webserver so I could argue you are running an OpenID provider. It 's just an implementation detail that the request is forwarded to another one.

Improve this answer
3
  • Thanks for your answer. While it’s no solution for me (because I really want to be the provider, as in: don’t give a third-party data about me, don’t have to search another service in case they shut down, etc.), your answer can certainly be an alternative for people that don’t require it.
    – unor
    Oct 20, 2017 at 13:02
  • well that's the thing: if the provider shuts down, you just have to point to another provider in the delegation. as for the data, I already have that account there: the extra data I give out to launchpad is which sites I connect to, when and where from.
    – anarcat
    Oct 20, 2017 at 13:25
  • I know, that’s why I said "search", as I would have to find a third-party service again (and again …), possibly finding no trustable one anymore (and in my case, I won’t even find a single trustable one the first time, hence my question :)).
    – unor
    Oct 20, 2017 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.