Overview of OpenIDSampleStores

Google has created a few websites that demonstrate log in systems which use an account chooser to support identity providers based on federated login techniques such as OpenID.

• openidsamplestore.com/basic: Only supports identity providers that are email providers. This requires much less work by the website owner then the next demo.

  • Also try the mobile login experience

• openidsamplestore.com/advanced: Supports identity providers who are not always the user's email provider. These types of identity provider require much more work by the website as described below.

• openidsamplestore.com/social: Extends the advanced demo to also support a local social graph on the site that allows users to follow people they find on the site, and to bring in their friends from their social network. Note: This demos social features can be slow, so sometimes you need to a wait a few minutes or just try again/

Frequently Asked Questions

What features of the site are interesting to test?

Here are videos of basic scenarios, and you can try out these scenarios yourself on the live website.

• An overview of an account chooser Note: video needs to be updated to use the demo OpenCart basic site

• An existing user on the site upgrading to OpenID Note: video needs to be updated to use the new OpenCart basic site

• A new user registering for the site with OpenID using a button or by just using their email address Note: video needs to be updated to use the new OpenCart basic site

• Using the website’s mobile app (to download the mobile app yourself, search the Android Marketplace for openid and you should see it listed). The mobile app was built using this industry technique. Note: video needs to be updated to use the new OpenCart basic site and new Android app. Should also have a video of the iphone app. And the technique article needs a pointer to open source code locations.

How does the advanced demo work for identity providers who are not E-mail providers, such as social networks?

The hardest part about designing the advanced site was to find a way to handle all the edge-cases that can happen with these types of identity providers. Google previously published a summary of best-practices for account-linking that describes why these types of identity providers are so much harder to support. However this demo provides a user self-service mechanism for all the tricky cases to avoid the costs that a website might otherwise occur if those users contact a customer support representative. It is based on this summary of the logic for complex IDPs. Note: need to update that summary with a pointer to the open source code.

Here are videos of advanced scenarios, and you can try out these scenarios yourself on the live website: Note: all these videos need to be updated to use the new OpenCart advanced site. Not sure if I should use Google as the IDP or a social network. If I use Google, the videos need to explain why Google is a mixed provider and that not all Google accounts are gmail accounts.

• An existing user on the site linking their account to an identity provider

• A new user registering for the site by using the button of an identity provider or by just using their email address

• A user who changes their email address on their identity provider and the really hard edge case where the new email address matches a second existing account on the site

How were the websites built?

They were built by taking a popular e-commerce website package, OpenCart, and then extending the login system using the Google Identity Toolkit. That toolkit is designed to help any website use an account chooser with identity providers.

Does a website have to use the Google Identity Toolkit to support this user experience?