OpenID Connect delegation with Google now that they are deprecating their OpenID2 provider?

OpenID Connect only supports Discovery that is meant to find your Provider based on some hint you give it (e-mail, account, URL, domain etc.); it won’t give you a persistent identifier for which you can delegate authentication to a configurable Provider of your choice.

So if you only want to use a custom URI to find your provider, you can use the approach that Nat gave (except for the last bit that Google does not and can not do and assuming that SO supports Discovery).

But if you want true delegation, so that RPs can use an identifier returned by the OP that is persistent over different OPs that you delegate to, then you can’t.

For StackOverflow you probably don’t need either one of those: SO uses its own primary identifier/account and you can link several accounts to that, including Google’s. Only if SO would have used your custom URI as its primary identifier you would have had a problem. In this case there’s no problem and you can:

  1. use the Google login button, or
  2. type your custom URI in the OpenID URL entry box, assuming both you and have implemented Discovery

But both 1. and 2. really yield the same result: they find out that Google is where you want to authenticate.

Leave a Comment