A few months back, I have been struggling to have openID authentication loaded to my application. It’s a hazard… the simple idea of having it integrated to my application and have users logged in using their existing facebook, google account is pretty fancy, but the code behind it is a mess, a complete tragedy. Luckily RPXNow stepped in and provided me a hand in authenticate people and handling the magic works. No one likes to reinvent the wheel after all, and this is a PRETTY HARD wheel to deal with…

how_diagram

How RPX Works

Also, I’ve been exposed to the wonderful world of Codeigniter, and have found a wonderful library handling all the dirty works for me, (75% of those have been dealt with by RPXNow). All I have to do is have a small iframe in my view, and then deal with what I have to offer when I have successfully authenticated the users.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
function login()
{
    $this->load->library('openidrpx');

    // In the view, display an iframe pointing to the "embedurl"
    $this->load->view('loginview', array('embedurl', $this->openidrpx->EmbedUrl('start/openidverify'));
}

function openidverify()
{
    $this->load->library('openidrpx');
         
    if($token = $this->input->post('token'))
    {
        $data = $this->openidrpx->AuthInfo($token);
       
        if($id = OpenIDRpx::Identifier($data))
        {
             // Authorize user!
        }
    }
}

However…

The idea is great, having some other web service do the dirty authentication work, and have a web framework ready library to do the integration dirty work… Having not to dirty your hands, but get things done. This is too easy to be true. But… I think using RPXNow is a bad idea, at least for me.

By using RPXNow, I am entrusting a third party site to deal with my users. There’s an extra hop in the process and thus, I am really relying on their service for my login process… What if they gone out of business for a while…?

Also, when the users login, the OpenID provider will direct them to yoursitename.RPXNow.com instead of your root website. Although RPXNOw offers ability to customize this hopping point, or with an extra cost ($20/month) to have it named as your root website (www.yoursitename.com). This serves to confuse your naive user even more.

By having a monthly fee, you can whitelist/blocklist certain provider, but this feature is not available in the free ones.

So!

It’s up to you, if you are really confident that you can deal with OpenID on your own, I suggest you do. But if you have absolutely no idea of how to even start looking at the problem, RPXNow is a definitive choice, it saves you “10 years of pain of extensive coding” and have your application up and running in under 2 hours (or less!!!). And if you like RPXNow and pay to be a loyal customer, you’ll gain a lot of extra functionality.