What security issues are involved with cross-domain logons using OpenID?

Question

I want to implement cross-domain logons for 3 sites. Is OpenID the best tool for protecting my site and users?

Answer 1

As far as I'm aware OpenID is reasonably secure. The downside to OpenID is that it's fairly complicated for non-technical users to understand. Something like this might make that a little easier on your users. There are options to make your site the OpenID provider, but they don't seem ready for production sites yet from a brief skim through the issues.

Another option might be OAuth. This would let your users log in with their accounts from sites like Facebook, Twitter and LinkedIn.

If all 3 sites are Drupal sites, one final solution might be to share the users between the sites, by sharing certain database tables. This would allow you to share other information about your users between the site profiles as well.

This page on Drupal.org describes the details, as well the downsides. Main one being that upgrades to major Drupal updates aren't supported. I honestly wouldn't recommend this unless you know a great deal about how the database side of Drupal works.