Dr. Dobb's Journal - October 2008 - (Page 40)

D10weis_p5db 8/15/08 9:39 AM Page 40 Core Technology by Jeremy Weiskotten OpenID Single Sign-On Jeremy is a software engineer at PatientsLikeMe (www.patientslikeme.com), a social network and health-management tool. He can be contacted at jeremy@weiskotten.com. Adding authentication to your web applications Many software applications—including websites—offer features that are only available to users who first log-in to the system. In a typical application, user identity is confirmed (“authenticated”) upon entering the username and password for the account. This approach is straightforward and works, but there are drawbacks. For instance, most apps reinvent the wheel when it comes to authentication, and many do-it-yourself implementations are easily exploited because developers may not have expertise in security. Users are usually required to remember a username/password for every application they use, which can be problematic. OpenID (www.openid.net) is an open standard that defines a way that web-based applications (“consumers”) can authenticate users by delegating the responsibility of authentication to identity providers. With OpenID, users have a single identity that can be used on any OpenID-enabled application, and they only need to remember one password. In this article, I describe the OpenID authentication system and show how a web application built with Ruby on Rails can use OpenID to authenticate its users. be an OpenID consumer. Here’s the general workflow when Bob logs into his Drupal account through OpenID: 1. Bob visits his Drupal-driven website. 2. Bob enters his OpenID identity URI, “bobs-id.myopenid.com,” in the login form and clicks a Submit button. That’s his OpenID identity URI, which looks like a website address, but identifies Bob and his identity provider. 3. Bob’s web browser is redirected to a web page served by myOpenID, where he is prompted for his password. 4. Bob enters his OpenID password and clicks a Submit button. 5. myOpenID confirms Bob’s password, and his web browser is redirected to Drupal with some information about Bob. How OpenID Works OpenID relies on the HTTP protocol to exchange messages between “consumers” and “identity providers.” Consider a user named Bob, whose identity provider is myOpenID (www.myopenid.com). Bob uses the Drupal content-management system that happens to 40 Dr. Dobb’s Journal l www.ddj.com l October 2008 http://www.patientslikeme.com http://www.patientslikeme.com http://www.openid.net http://c63bobs-id.my-openid.com http://c63bobs-id.my-openid.com http://www.myopenid.com http://www.ddj.com

Table of Contents Feed for the Digital Edition of Dr. Dobb's Journal - October 2008

Dr. Dobb's Journal - October 2008 Contents Friday Night Fish Fry Alia Vox Developer Diaries Developer’s Notebook Is Your Next Language COBOL? Conversations Safe Coding Practices Code Signing in Adobe AIR OpenID Single Sign-On The Book Cipher Algorithm Indexing and Searching Image files Extending Continuous Integration Into ALM The Agile Edge Effective Concurrency Swaine’s Flames

Dr. Dobb's Journal - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.