This topic was mentioned in IwamotoTakashi’s diary (here, here, here, and here) and in ZIGOROu’s diary, so I will briefly organize the points.
The question is: “Which identity of an end user should an RP recognize as a unique user?”
OpenID 1.1
[Request]
openid.identity := Claimed Identifier
The Claimed Identifier is the identifier that the user claims to own,
and it is expected to remain unchanged over a long period.
[Response]
openid.identity := Verified Identifier
Therefore, when delegation is used, it becomes the ID verified
at the delegation target.
The delegation target may change frequently.
Therefore, what the RP can use as a key is the Openid.identity in the Request == Claimed Identifier.
OpenID 2.0
[Request]
openid.claimed_id := Claimed Identifier or identifier_select
The Claimed Identifier is the identifier that the user claims to own,
and it is expected to remain unchanged over a long period.
For XRI, it is the Canonical ID, and multiple inames may be
associated with it. Even in that case, they are regarded as
the same person.
However, when an OP Identifier is used, the user does not
present a Claimed Identifier in the request, so the values of
openid.claimed_id and openid.identity are always
http://specs.openid.net/auth/2.0/identifier_select
.
openid.identity := OP-Local Identifier
Unless something different is specified, the Claimed Identifier
MUST be used as openid.identity.
If http://specs.openid.net/auth/2.0/identifier_select is
specified, the OP must select and present an ID belonging
to that user. (Y! is an example of this case.)
Generally, this is the ID verified at the delegation target.
See the example in Appendix A.3 of the Spec.
[Response]
openid.claimed_id := Claimed Identifier.
For XRI, this is the Canonical ID.
When an OP Identifier is used, this is the OP Local Identifier
selected by the OP.
openid.op_endpoint := OP Endpoint URL
The URL that verifies the OP Local Identifier.
openid.identity := OP Local Identifier
The Identifier actually verified at the OP Endpoint URL
(the verified identifier of the OpenID 1.1 era).
Incidentally, claimed_id and identity are either both present or both absent.
Now, regarding the issue of what should be used as the primary key for an account on the RP side, the Spec states it clearly for 2.0.
11.5. Identifying the end user
The Claimed Identifier in a successful authentication response SHOULD be used by the Relying Party as a key for local storage of information about the user. The Claimed Identifier MAY be used as a user-visible Identifier. When displaying URL Identifiers, the fragment MAY be omitted.
Thus, in a word, the primary key is always the Claimed ID.
In other words, the primary key should be:
OpenID 2.0: openid.claimed_id in the response
OpenID 1.1: openid.identifier in the request
That is the conclusion.
An easy way to remember it is: “Use what does not change as the key.”
Related posts
OpenID vs. OAuth
It is often said that OpenID is for authentication and OAuth is for authorization. This was originally something that people involved with OAuth in the United…
On the SAML/OpenID Comparison Table in IPA’s “Identity Management Technology Guide”
On August 9, the Information-technology Promotion Agency, Japan (IPA) released a draft of a textbook titled “Identity Management Technology Guide” [1]. The 8 edition is still…
Yahoo! U.S. Launches Its OpenID Service
Yahoo! U.S. has launched its OpenID service. Here is the announcement. So I immediately tried logging in here with my U.S. Yahoo! ID, but... Hmm. It…