OpenID is a set of protocols for user-centric digital identities. These protocols allows users to create an identity online, using an identity provider. This identity can be used on any site that supports OpenID. Using OpenID-enabled sites, users do not need to remember traditional authentication tokens such as usernames and passwords for each site. All OpenID-enabled sites accept a single OpenID identity. This identity is typically a URL. It may be the URL of the user's personal page, blog or other resource that may provide additional information about them. That mean a user needs just one identifier for all sites he or she uses. services. OpenID is an open, decentralized, and free user-centric solution. Users may choose which OpenID provider to use, or even create their own personal identity server. No central authority is required to approve or register OpenID-enabled sites or identity providers.

For more information about OpenID visit the » OpenID official site.

The purpose of the Zend_OpenId component is to implement the OpenID authentication protocol as described in the following sequence diagram:

1. Authentication is initiated by the end user, who passes their OpenID identifier to the OpenID consumer through a User-Agent.

2. The OpenID consumer performs normalization and discovery on the user-supplied identifier. Through this process, the consumer obtains the claimed identifier, the URL of the OpenID provider and an OpenID protocol version.

3. The OpenID consumer establishes an optional association with the provider using Diffie-Hellman keys. As a result, both parties have a common "shared secret" that is used for signing and verification of the subsequent messages.

4. The OpenID consumer redirects the User-Agent to the URL of the OpenID provider with an OpenID authentication request.

5. The OpenID provider checks if the User-Agent is already authenticated and, if not, offers to do so.

6. The end user enters the required password.

7. The OpenID provider checks if it is allowed to pass the user identity to the given consumer, and asks the user if necessary.

8. The user allows or disallows passing his identity.

9. The OpenID Provider redirects the User-Agent back to the OpenID consumer with an "authentication approved" or "failed" request.

10. The OpenID consumer verifies the information received from the provider by using the shared secret it got in step 3 or by sending an additional direct request to the OpenID provider.

Zend_OpenId consists of two sub-packages. The first one is Zend_OpenId_Consumer for developing OpenID-enabled sites, and the second is Zend_OpenId_Provider for developing OpenID servers. They are completely independent of each other and may be used separately.

The only common code used by these sub-packages are the OpenID Simple Registration Extension implemented by Zend_OpenId_Extension_Sreg class and a set of utility functions implemented by the Zend_OpenId class.

Note: Zend_OpenId takes advantage of the » GMP extension, where available. Consider enabling the GMP extension for enhanced performance when using Zend_OpenId.

The Zend_OpenId component supports the following standards:

• OpenID Authentication protocol version 1.1

• OpenID Authentication protocol version 2.0 draft 11

• OpenID Simple Registration Extension version 1.0

• OpenID Simple Registration Extension version 1.1 draft 1