Feature of the week: OpenID support in BibSonomy

OpenID is an open, decentralized standard, which allows users to log onto many different services on the web using the same identity identification (single sign-on). This kind of authentication is provided by a growing number of websites, including large ones like AOL, Google, Microsoft, MySpace, Yahoo and many others. And now for the good news - we are happy to announce that BibSonomy is among those!

OpenID makes registering at BibSonomy a lot easier. If you already haven an OpenID, you can go directly to our register page and click the link "register using OpenID" at the bottom:
In the next step, you enter your OpenID:
Then, you will have to confirm your BibSonomy registration at your OpenID-Provider (in this example myopenid). When you trust BibSonomy, you should activate the checkbox "Skip this step next time I sign in to www.bibsonomy.org" - then you won't be redirected to your OpenID provider the next times you log in to BibSonomy:

And finally you can complete your user settings. Please note that your name, gender and other information is fetched from the OpenID-server, so you don't have to retype all those details each time your register:
The next time you want to log in to BibSonomy, you can do this by clicking the link "Login with OpenID" at the bottom of our login page.

If you do not know your OpenID, it might nevertheless be the case that you already have one, e.g. when you have a Flickr account - refer to the official OpenID page to find out more details on this. Please note that OpenID will On the same site you will find information how to obtain a brand new OpenID, which can then then make your online experience easier and better - including BibSonomy!

Best,
Dominik

A note on problems with Google-based OpenID logins

Recently we got mails from users that can not login to BibSonomy using their Google OpenID. Today we traced at least one of the cases down to a problem with Google's OpenID service.

There are two types of OpenID's Google supports:

• The "one for everybody" OpenID https://www.google.com/accounts/o8/id.
• Your personal Google Profile page, e.g. https://profiles.google.com/114248476628351395042.

There are quite some web pages that discuss the different types (e.g., this discussion, this explanation, or this article) and even more forum posts that describe problems (e.g. this one).

The thing is, that recently the profile page OpenID's cause problems. We were not able to login or register using these at BibSonomy. After trying to find out why this does not work, we found out that the problem is Google itself. Google's profile web pages do not contain a resource descriptor that OpenID4Java can discover. We could not even find one manually. This basically means, that the  https://profiles.google.com/ type of OpenID is broken.

By the way: not only BibSonomy has problems with Google's profiles OpenIDs, other web pages have them, too. We tried to register at Stack Overflow using https://profiles.google.com/114248476628351395042 and got the error "Unable to log in with your OpenID provider: No OpenID endpoint found."

Until Google fixes this issue, we can only suggest to use the other type of OpenID, i.e., https://www.google.com/accounts/o8/id to sign in to BibSonomy.

To make this easier, we enhanced the OpenID login page to include quick-links for three major OpenID providers: Google, Yahoo!, and myOpenID.net:

We will stay tuned with this problem and see, if Google will fix it!

Have a nice weekend and enjoy tagging ...

Update (2011-08-02):

Since last Friday (2011-07-29), we had problems with OpenID login caused by an incorrectly installed SSL certificate. This was fixed today. Thus, OpenID login with providers such as Google, Yahoo! or Xlogon.net works, again.

With MyOpenID.com, however, we still face problems. The reason seems to be that the root certificates for the certification authority MyOpenID.com uses (StartCom) are not contained in the JVMs truststore (bug entry on openid4java). We imported them manually but this did not solve the problem. We will try to find out what's going wrong.
<update> OpenID with MyOpenID.com works now. Importing certificates with Java's keytool command is quite cumbersome. It ask's for a password but does not complain that no keystore was specified. :-(</update>