Really lost with OpenID and ASP.NET MVC
I'm trying to implement OpenID using ASP.NET MVC (yes, we haven't heard this before I'm sure!)
This is really not a big problem. My huge problem is that I am very confused about how to do this together with an application that will need to store a lot of information about registered users (profiles, stories, etc.).
It seems to me that OpenID takes away site-centric logic and makes it open. It's all well and good if you just make an authentication ticket that is considered a "verified" user - but in all seriousness I'm completely lost. Is it possible to implement OpenID in such a way that logging in allows users to "exist" in my own application as if they had passed regular registration?
I was reading the code for the NerdDinner 2.0 application that implements openId, hoping that it will answer my question, but alas, I don't find such hints.
source to share
The typical way to do this is to simply associate OpenID with an existing user account. I have an association table in my cases, as a user can have multiple OpenIDs.
So, if I have an account and I register with https://openid.org/steven , then it maps to an existing account.
source to share
The most important thing to understand here is that the OpenID provider has no control over the user session. It only gives you the user id associated with that user. Optionally, you can also request some data about the user. This means you don't need to manage any user data other than the OpenID user ID. In most cases, you want to associate this ID with a user in your database, but this is not required.
But you need to manage the session yourself. When you log into OpenID, you don't have the prompt that you actually entered into the system. All he knows is that you have communicated with the provider. This means the mvc actions that are applied AuthorizeAttribute
to still fail. To do this, you have to issue FormsAuthenticationTicket
like this:
private void IssueFormsAuthenticationTicket(string identifier, bool rememberMe)
{
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
1, //version
identifier, //name
DateTime.Now, //issue date
DateTime.Now.AddDays(14), //expiration date
rememberMe, //is presistant
identifier //user data
);
//Now we encrypt the ticket so no one can read it...
string encTicket = FormsAuthentication.Encrypt(ticket);
//...make a cookie and add it. ASP.NET will now know that our user is logged in.
Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket));
}
This is a simple version of this. Then you can access the id data using User.Identity.Name
.
If you want some user data to be stored in your database, you can do so through the registration form that follows the OpenID and associate the identifier with the account (you can also support linking multiple OpenIDs to one account). I already mentioned, you can also request data from the provider and use it for automatic registration. But be careful as all vendors don't always supply everything, even if you say you have it.
Google, for example, only provides data that is marked as required. I'm just ignoring all the requests for data that you would like to get if you can get it, but really shouldn't be. MyOpenID will provide you with all the data marked as necessary and requested, if the user fills in it in his person. But the login will even succeed if the Persona user does not have the details that you have checked out as needed.
Implementing OpenID in ASP.NET MVC is best done with DotNetOpenAuth in my opinion. They also have a sample for MVC, which is the simplest as it comes in, but it works. The example does not show how to query for this user, but you can find it in NerdDinner.
source to share