I would like to publish a website for certain family members only. Simply put, like a mishmash of family photos and videos. I want it to remain private, however.
I was considering using openid for the login process because I really wanted to avoid:
- Storing Usernames and Passwords (Too much maintainance)
- Making a obfuscated url that can be picked up by toolbar (Not private enough)
- Making a password to access the page (I've had users unable to manage this)
So I was hoping to use openid to have say my brother log in using his google account.
But from what I've seen openid used for, it wouldn't prevent others from logging in to the website. I was thinking maybe I could limit it manually however this paragraph from Google App Platform best practices has me double thinking:
From a protocol perspective, both logins to the two IDPs are legitimate and the attributes returned by the 2nd IDP appear identical — the same email address, name, and so on. The only thing that differs between the two requests is the user's claimed identity. In fact, relying parties are required to verify that IDPs only return identities that they're authoritative to prevent a rogue IDP from asserting identities from other providers. But nothing prevents a rogue IDP from asserting attributes like names and email address that may not be truthful.
Is openid the "right" tool for what I wish to do? (Have a private web interface that requires logins but no user management beyond identifying family members)