OpenID 重定向
我想在我的网站上实施 OpenID，但我想知道我是否也可以请求 OpenID URL 和密码。例如，
OpenID URL：[ ] OpenID 密码：[ ]
我不想将其重定向到提供商（例如：myopenid.com），而是直接将信息从我的页面提交到提供商服务器，以进行身份验证。
这可能吗？如果是这样，怎么办？谢谢！
PS：我正在使用 PHP
编辑：这是一个班级项目，我们正在实现一个登录解决方案，用户只需输入 PIN 码而不是 [Open ID URL &密码]。这是安全存储的，因此我们无需担心安全问题。因此，我们需要一个解决方案来从安全数据库提交 OpenID URL 和密码，并将其提交给 OpenID 提供商。
I would like to implement OpenID on my website, but I would like to know if it is possible for me to request the OpenID URL AND password as well. For example,
OpenID URL: [ ]
OpenID Password: [ ]
Instead of redirecting it to the provider (eg: myopenid.com), I would like to directly submit the information from my page to the provider server directly, for authentication.
Is this possible? If so, how? Thanks!
P.S: I'm using PHP
Edit: This is a class project where in we are implementing a login solution where a user enters only a PIN number instead of [Open ID URL & Password]. This is stored securely, so we don't need to worry about security. Therefore we need a solution to submit the OpenID URL and Password from a secure database, and submitting it to the OpenID provider.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不，不是。
OpenID 的目标是防止网站所有者知道用户密码。
每个决定使用 OpenID 的人都知道这一点，并且不会使用您的表单。
另外，假设只有一个密码与 OpenID 关联也是错误的。
它可以是任何东西 - 例如它是 Google 的用户名/密码，另一个提供商也可以使用令牌......
No it is not.
The goal of OpenID is to prevent a site owner from knowing a users password.
Everyone who decides to use OpenID knows this and would not use your form.
Also making the assumption that there is only a password associated with an OpenID is wrong.
It could be anything - e.g. it is Username/Password for Google, another provider could also use a token...
使用 OpenID，密码永远不会与任何网站共享。你试图做的事情听起来很危险，而且对我来说似乎不值得信任。
使用 OpenID 的好处之一是用户可以选择多少网站可以查看他们的信息。这意味着利用 OpenID 的网站不会一遍又一遍地要求他们提供相同的信息，因此登录更快、更容易。如果您每次都要求他们输入密码，您也会失去这一好处。
使用 OpenID，您只需将密码提供给您的 OpenID 提供商，然后您的提供商就会告诉您正在访问的网站您就是您所声称的身份。除了您的提供商之外，没有任何网站会看到您的密码，因此您不必担心不安全的网站会泄露您的身份......
With OpenID, passwords are never shared with any websites. What you are trying to do sounds dangerous and would not seem trustworthy to me.
One of the benefits of using OpenID is that users are able to choose how much web sites get to see about them. This means that web sites that take advantage of OpenID won't bother them for the same information over and over again, so that it is faster and easier to sign in. If you require them to enter their password everytime, you also lose that benefit.
With OpenID you only give your password to your OpenID provider, and then your provider tells the websites you're visiting that you are who you say you are. No website other than your provider ever sees your password, so you don't have to worry about an insecure website compromising your identity…
嗯，这听起来很危险。登录的人如何知道您没有查看他们的密码？
当然，理论上您可以做到这一点，但没有理智的用户会使用您的网站。 :)
因您的编辑而编辑：
安全是什么意思？如果您希望能够将其发送给 OpenID 提供商，那么您当然可以检索它。在这种情况下，如何阻止侵入您系统的攻击者检索其他用户的密码。更糟糕的是，如果你的命运发生了转变，你可以利用这些信息来达到你自己的目的。
如果您能够这样做，数据库将不安全（即对您来说）。
Well that sounds dangerous. How do people logging in know that you are not looking at their passwords?
Sure you could do it in theory, but no sane user would use your website. :)
Edit because of your edit:
What does securely mean? Surely you can retrieve it if you want to be able to send it to an OpenID provider. In this case what stops an attacker that hacked into your system from retrieving other user's passwords. And even worse, if you have a turn of fate you could just use that info for your own purposes.
If you were able to do that, the database would not be secure (i.e. from you).
我什至没有 OpenID 密码，因为我使用 SSL 客户端证书登录。所以你问我的密码是没有意义的。
I don't even have an OpenID password since I login with a SSL client certificate. So there would be no point for you asking for my password.