Comment 14 for bug 210943

Revision history for this message
James Cuzella (trinitronx) wrote : Re: be an openid consumer (not provider)

I have another interesting point to make on this bug/feature request:

Allowing Launchpad to be an OpenID consumer would also enable extra authentication methods for users of Launchpad. It is important for Launchpad to ask a user for an email, this is of course inherent in Launchpad's purpose. However, allowing the ability to login via relaying the authentication to an external site will enable users to authenticate with very secure methods (read: NOT *just* a password!).

For an example of what I'm talking about, consider one time password devices such as the Yubikey (http://yubico.com), RSA tokens, SMS text messages with secret "out of band" communication to the user, etc... This is the future and purpose of OpenID in my opinion. To authenticate users in a very secure fashion, and enable them to use this same authentication method on many sites. For Lauchpad, this would allow developers to have a really secure way to distribute and manage projects. I agree that just having an OpenID at another site should not give users an automatic account here, Lauchpad should be allowed to ask for whatever information from the user that is needed to provide them with its services (email, GPG/SSH public keys, etc...).