Zend_OpenId is a Zend Framework component that provides a
simple API for building OpenID-enabled sites and identity providers.
OpenID is a set of protocols for user-centric digital identities. These protocols allow to create an identity online, using an identity provider. This identity can be used anywhere that OpenID is supported. Using OpenID-enabled sites, web users do not need to remember traditional authentication tokens such as username and password. All OpenID-enabled sites accept a single OpenID identity. This identity is typically a URL. It may be the URL of the user's personal page, blog or other resource that may provide additional information about them. No more need for many passwords and different user names - just one identifier for all Internet services. OpenID is an open, decentralized, and free user centric solution. A user may choose which OpenID provider to use, or even create their own personal identity server. No central authority is needed to approve or register OpenID-enabled sites or identity providers.
For more information about OpenID visit OpenID official site and look into the OpenID Book by Rafeeq Rehman.
The main purpose of the Zend_OpenId components is to
implement an OpenID authentication protocol as described in the following
diagram:
Authentication is initiated by the end-user, who passes their OpenID identifier to the OpenID consumer through a User-Agent.
The OpenID consumer performs normalization of the user-supplied identifier, and discovery on it. As result, it gets the following: a claimed identifier, OpenID provider URL and an OpenID protocol version.
The OpenID client establishes an optional association with the server using Diffie-Hellman keys. As a result, both parties get a common "shared secret" that is used for signing and verification of the following (subsequent) messages.
The OpenID consumer redirects the User-Agent to the OpenID provider's URL with an OpenID authentication request.
The OpenID Provider checks if the user-Agent is already authenticated and offers to do so if needed.
The end user enters the required password.
The OpenID Provider checks if it is allowed to pass the user identity to the given consumer, and asks the user if needed.
The end user allows or disallows passing his identity.
The OpenID Provider redirects the User-Agent back to the OpenID consumer with an "authentication approved" or "failed" request.
The OpenID consumer verifies the information received from the provider by using the "shared secret" it got on step 3 or by sending additional direct request to the OpenID provider.
Zend_OpenId consists of two sub packages. The first one
is Zend_OpenId_Consumer for developing OpenID-enabled sites
and the second Zend_OpenId_Provider for developing OpenID
servers. They are completely independent of each other and may be used
separately.
The only common parts of these sub packages are the OpenID Simple
Registration Extension implemented by
Zend_OpenId_Extension_Sreg class and the set of utility
functions implemented by Zend_OpenId class.
![[Замечание]](/images/note.gif) |
Замечание |
|---|---|
|