What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

All I hear is that OpenID works like a SSO for the whole Internet. Ok, how do I do the following:

I am on a site (not Stack Overflow), and I am logged in with my OpenID URL. Now I want to ask a question on Stack Overflow, and click a link to http://stackoverflow.com. As I understand things, with OpenID I should be logged in directly on Stack Overflow. But instead, I have to log in again with my OpenID URL on Stack Overflow. So where is the SSO?

Do I need some parameters on the URL, or something special to make it work?

share|improve this question

migrated from stackoverflow.com Feb 4 '10 at 20:31

This question came from our site for professional and enthusiast programmers.

3 Answers 3

Well, it's an authentication system, but it's not like you can just walk around. It's more like a doorman that stops you at every door, but recognizes that ID card.

share|improve this answer
2  
idspispopd - There, now I can just walk around. –  Adam Davis Feb 5 '10 at 3:23

It depends on your openid provider.

For instance, your path might be:

Go to somesite, use openID to login
That website calls up your openid provider to see if you are who you say you are
Your openid provider makes you log in with a username and password
Your openid provider then tells the website that you are a-ok with them
The website lets you in.

Now, if your provider supports caching of credentials for 24 hours, then on the same computer shortly after logging in you might do this:

Go to some other website, use openid to login
That website calls up your openid provider to see if you are who you say you are
Your openid provider finds the cached credentials
Your openid provider then tells the website that you are a-ok with them
The website lets you in.

In the second situation you still had to log in to the second website with openid, but you didn't have to provide username and password because you already did that once earlier in the day, and the provider caches the credentials.

Now if you move to another computer, wait for the cache to expire, or if your provider doean't cache the credentials, then you'll have to log in with your username and password.

But regardless, you'll have to tell the website who your openid provider is and/or your personal openid URL.

Stackoverflow and other websites may cache your provider info separately as well, so they might help you sidestep some of that process, but fundamentally openID does not save you from signing in to each website, it only saves you from having to have a separate username and password for each website.

share|improve this answer

Not possible because sending a openid and password in a query string is surely not secure. It's not a global login system where you login once and suddenly you are logged in for all of the internet. Cookies prevent this because a cookie can only be read from the domain it is generated fro

share|improve this answer

You must log in to answer this question.