I would like to publish a website for certain family members only. Simply put, like a mishmash of family photos and videos. I want it to remain private, however.

I was considering using openid for the login process because I really wanted to avoid:

  1. Storing Usernames and Passwords (Too much maintainance)
  2. Making a obfuscated url that can be picked up by toolbar (Not private enough)
  3. Making a password to access the page (I've had users unable to manage this)

So I was hoping to use openid to have say my brother log in using his google account.

But from what I've seen openid used for, it wouldn't prevent others from logging in to the website. I was thinking maybe I could limit it manually however this paragraph from Google App Platform best practices has me double thinking:

From a protocol perspective, both logins to the two IDPs are legitimate and the attributes returned by the 2nd IDP appear identical — the same email address, name, and so on. The only thing that differs between the two requests is the user's claimed identity. In fact, relying parties are required to verify that IDPs only return identities that they're authoritative to prevent a rogue IDP from asserting identities from other providers. But nothing prevents a rogue IDP from asserting attributes like names and email address that may not be truthful.

Is openid the "right" tool for what I wish to do? (Have a private web interface that requires logins but no user management beyond identifying family members)

  • 1
    Interesting question! From the document linked to it seems that your approach would work if you restrict the IDPs (for example if you know that every authorized user will use Google, then allow only Google). Aug 10, 2012 at 10:48

2 Answers 2


You can use OpenID for this as long as you request the user's email address and confirm it's that of a family member. So you're backend or settings code should have a list of family email addresses. Anyone else authenticating over OpenID could immediately be booted by your web application.

Think of the OpenID as an identifier for the user. The choice to trust and finally authenticate is up to you.

  • 2
    If the user can select which IDP to use than anyone could claim any email address easily, even if they don't actually controll that address (by simply running their own rouge IDP). So no: checking the email address alone is not sufficient. Checking the email address and restricting the IDPs to a set of trusted (or known-good) IDPs would be sufficient. Aug 10, 2012 at 10:47

Totally agree with Matt here. You can use social login/Open Id plugin along with some sort of private beta functionality which can help you in defining access for the user. LR Social login provides this functionality though at premium :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.