Search code examples
c#openiddotnetopenauthopenid-selector

OpenID 2 and openidselector Store in SQL


I am implementing OpenID 2 (and/or OAuth 2) and also using the openidselector on my web application. What should I store in my SQL database so that I can match users up to my data when they login? For example, when a user logs in using Google, Twitter, OpenId or Facebook what key(s) should I store so that I can query other information out of my database? What should I use as a member id?


Solution

  • The unique user information varies depending on which protocol you're using. For OpenID (which Google also uses) the member id is found in the IAuthenticationResponse.ClaimedIdentifier property in DotNetOpenAuth. For OAuth, which wasn't designed for authentication but is sometimes misused as such (Twitter and Facebook) there is no standard for a user identity, so you have to read their service docs to figure out what part of their OAuth responses include their member IDs and store that.

    A user table that stores both OpenID Claimed Identifiers and various OAuth services' usernames can be tricky to get right. Be careful.