Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

For example:

  • We're running a two community sites on two domains (call them example.com and example.net).
  • We want to be able to expand that to more domains later.
  • We want to allow multiple types of login (OpenID, Facebook, Twitter, standard username/password).
  • We want someone who's logged into one site to automatically be logged into the other(s).

In other words, it's a bit similar to the StackExchange network.

In this case, would this plan work?

  • Set up example.com and example.net (and any later additions) as OpenID relying parties, which accept OpenID login from id.example.org only.
  • Set up example.com and example.net to do an OpenID reply-immediate request the first time you visit them, so that if you're logged into id.example.org you're immediately and automatically logged into the site you're visiting. They should set a cookie if you're not logged in, to save them doing this on every page request.
  • Set up id.example.org as an OpenID provider and consumer. It should also consume Facebook and other identity providers, and allow standard username/password access. (Multiple login methods could be attached to one account.)
  • On logout, simply change the authentication tokens in the database. The user will still have cookies, but they'll be meaningless. Thus can the user be signed out of all sites simultaneously. Multiple authentication tokens can be stored against one user at one time (and should be different for each site), so that the user can sign out in one browser but still be signed in in another. Signing out always signs out for all sites.

The only problem I can see with the above is this:

  • Someone visits example.com. A "not-logged-in" cookie is set.
  • Zie then goes onto example.net. Ditto.
  • Zie then signs in, and continues browsing on example.net.
  • Zie then goes back to example.com and, because of the "not-logged-in" cookie, is not checked against id.example.org and is therefore not logged in.
  • However, as soon as zie clicks the "log in" button, zie is logged in.

I don't think this is a major problem.

On the whole, I think it's a pretty good system. I'd just like to see it reviewed. Are there any problems I haven't foreseen? Would it be buggy or slow? StackExchange uses a very different method. I assume they have a good reason for that?

share|improve this question

closed as off topic by Mark Trapp Oct 4 '11 at 0:57

Questions on Programmers Stack Exchange are expected to relate to software development within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
would this be better asked at webmasters.stackexchange.com? –  Doug T. Sep 11 '11 at 18:43
    
@Doug: Done: webmasters.stackexchange.com/q/19652/2776. –  TRiG Sep 14 '11 at 14:55
    
I guess so much for that idea! I guess I shouldn't have suggested that. –  Doug T. Sep 14 '11 at 16:09

1 Answer 1

Movable Type uses a very similar login method to the one you describe. I personally do not mind it, but there are times when I present it to a customer and they can help but ask, "what exactly is going on here?"

The project I have been most intrigued by with regards to creating a coherent login system is the Google Identity Toolkit. The user experience is spot on, and the ease with which it appears to be implementable is very appealing.

share|improve this answer
1  
Google properties which aren't hosted via google.com (YouTube, for example) also use this kind of workflow. (If I visit YouTube, then log into my Google account at GMail, then go back to YouTube, I'll stay logged out until I click "log in" at which point, the current page reloads with me logged in) –  ssokolow Sep 19 '11 at 2:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.