1

I am tasked to design an OpenID provider for the public facing applications of my company.

The idea is to authorize the user via an email/PW combination. The subject will be a GUID.

Should an user be able to change his email address (that is used for login) or should there be a changeable contact email address.

3
  • Be aware that designing an OpenID provider does not solve the problem of authenticating your site. An OpenID provider is used to allow your site to authenticate other applications. Authenticating your users is an entirely separate problem (which can be done by supporting OpenID, but not as a provider). In general, only highly popular, user-facing sites should fulfill this role (mostly social networks and email providers).
    – Brian
    Commented Sep 8, 2016 at 13:30
  • @Brian I am aware of that. Our company currently runs 8 different,popular, public-facing applications, with currently all having their own authenticating logic. Since that spins out of control we need to unify our authenticating process. We are currently not planing on becoming an public OpenId provider (even though we most definitely would have the user base to do so).
    – TheJoeIaut
    Commented Sep 8, 2016 at 13:46
  • That's still kind of an abuse of the protocol, though it does work. OpenID is designed for users who don't trust their site provider with their credentials. Way simpler is for the 8 sites to talk to a central authentication server (Amazon Cognito provides this as a service) and to submit the authentication tokens to that server directly . But as you say, that's not the solution management wants.
    – Brian
    Commented Sep 8, 2016 at 19:08

1 Answer 1

Reset to default
2

What do requirements tell? This is the only authoritative source in this case, so refer to the requirements.

If you are asking the question because you're actually drafting the requirements themselves, then take in account that:

  • Persons change e-mail addresses occasionally. Either because they change the provider, or because their old address receives too much spam, or because they don't like their old e-mail address any longer. Whatever. Preventing a person from changing the e-mail on your website would eventually result in this person not being able to use the site any longer.

  • Switching the e-mail address originally used for registration isn't a mundane task. For x valid uses of this task, you'll have y piracy attempts (an attacker gained access to the account of the person and switches to the attacker's e-mail address). It's up to you to protect your users against those attacks.

    This is much more difficult than it looks like. One of the problems is that a legitimate person who needs to change her e-mail address on your website may sometimes not have access to the original e-mail account, so sending an e-mail with a validation link is not an option here.

  • Doing this the old way—asking the person to send you a letter or call support—may be easier to implement. However, one should ask himself how an identify of a person can be confirmed through a phone call.

  • When the e-mail is changed, you may legally be required to keep the previous e-mail addresses.

The idea is to authorize the user via an Email/PW combination.

What about two-factor authentication?

Seriously, ask yourself if you really, really need to do your own OpenID provider from scratch. If you have 10k reputation on InformationSecurity.SE and you have a professional experience in authentication/registration systems, please, do. Otherwise, you are putting your users and your company at risk of piracy.

3
  • Thanks for your answer! The decision to use OpenId was made by upper management (and it's a better decision then their orignal plan to build something from scratch).
    – TheJoeIaut
    Commented Sep 8, 2016 at 12:34
  • @TheJoeIaut: Well, on the plus side OpenID is a standard, so you're in a far better position to argue in favor of using (popular, well-vetted) third party libraries while as part of "implementing" OpenID..
    – Brian
    Commented Sep 8, 2016 at 13:09
  • @Brian Of course were using third party frameworks (in our case Identity Server). Implementing the open ID Standard on our own was never topic of the debate.
    – TheJoeIaut
    Commented Sep 8, 2016 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.