If I understand correctly, Facebook is not an OpenID provider as it uses OAuth 2.0 right now. However, on Stack Overflow's login page, it's grouped together with providers like Google, Yahoo and MyOpenID, and there's a short overview about OpenID on the right sidebar, which together gives an impression that Facebook is also an OpenID provider.

Facebook Connect doesn't comply with the OpenID specification, so why is it portrayed as a provider?


We probably should stop referring to "OpenID" anything altogether since the term tends to just cause varying amounts of confusion among our users.

In the meantime, we don't make any distinction between actual OpenID providers and everything else because the distinction is largely meaningless. Being technically correct about each specific protocol doesn't buy us much. All that matters if that folks can use an external login provider to authenticate with our sites.

  • aah I see. So you are indeed using OAuth 2.0 to authenticate users via Facebook, but discarding the token afterwards? I presume that because I signed out from Facebook, but was still logged in SO.
    – Songo
    Oct 4 '13 at 16:14
  • @Songo I'm hazy on the implementation, but basically yes. We don't care how you signed in after the login process is complete. And we don't communicate with FB on your behalf, so we have no use for the OAuth token.
    – Adam Lear StaffMod
    Oct 4 '13 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .