[Python-Dev] Too many Python accounts

"Martin v. Löwis" martin at v.loewis.de
Sun Nov 15 03:31:04 CET 2009


> Fred can use his own OpenID ‘fred.example.org’, initially set up behind
> the scenes to delegate to ‘bigcorp.example.com’ as the provider. Any
> time he likes, Fred can *change* which provider is actually used for
> authentication, without changing his OpenID. PyPI gets to find out which
> provider Fred is using for the identity ‘fred.example.org’ each time it
> performs discovery on that identity, not before.

Does that actually work? What actual OpenID provider allows me to claim
'fred.example.org' as my OpenID? Sure, one can use authentication
delegation, by means of the openid.delegate link. However, that still
doesn't make the claimed identifier fred.example.com, but
bigcorp.example.com/fred.

So the only thing users gain with delegation is that they don't need
to remember the tedious URL that their provider assigns them. When they
switch providers, their claimed ID will still change, and they'll have
to reregister in all services they use.

Please correct me if I'm wrong.

Regards,
Martin


More information about the Python-Dev mailing list