For example:
example.com
and example.net
).In other words, it's a bit similar to the StackExchange network.
In this case, would this plan work?
example.com
and example.net
(and any later additions) as OpenID relying parties, which accept OpenID login from id.example.org
only.example.com
and example.net
to do an OpenID reply-immediate request the first time you visit them, so that if you're logged into id.example.org
you're immediately and automatically logged into the site you're visiting. They should set a cookie if you're not logged in, to save them doing this on every page request.id.example.org
as an OpenID provider and consumer. It should also consume Facebook and other identity providers, and allow standard username/password access. (Multiple login methods could be attached to one account.)The only problem I can see with the above is this:
example.com
. A "not-logged-in" cookie is set.example.net
. Ditto.example.net
.example.com
and, because of the "not-logged-in" cookie, is not checked against id.example.org
and is therefore not logged in.I don't think this is a major problem.
On the whole, I think it's a pretty good system. I'd just like to see it reviewed. Are there any problems I haven't foreseen? Would it be buggy or slow? StackExchange uses a very different method. I assume they have a good reason for that?
Overall, your setup looks fine. Hope you've covered handling session expiry/timeouts.
The only issue (and its more of an inconvenience) I see is the need to click 'Log in' explicitly. Personally, I prefer auto logins (like Google, MS and ton of other major sites).
SO detects if you've a valid login and shows a message asking to refresh the page. While somewhat annoying, it still at least tells me that I'm logged in.