« Rivers of Information and Social Media | Main | Alan Kay Organick Lectures »
Using Google's Universal Authentication Engine
Google’s Chat service, GTalk, is based on XMPP, the protocol behind Jabber. That’s why you can use any Jabber client with GTalk. This has other implications beyond chat clients, however. XMPP has a very capable authentication mechanism built-in to service distributed chat servers, but you can use XMPP authentication for anything. Google has conviniently tied this authentication service to your Google account. That means that you could build an application that let’s people log in using their Google account name (what I call GIDs) and password without any prior arrangement with Google. With no fanfare at all, Google has created a universal login for anyone who wants to use it.
Posted by windley on February 7, 2006 11:49 AM
Comment from Darren Chamberlain at February 7, 2006 12:43 PM
Doesn't Flickr's authentication API (http://flickr.com/services/api/auth.spec.html) offer something similar, i.e., allow you to authenticate a user based on their Flickr account? Of course, it doesn't use XMPP, so it's not as immediately assimilatable into as many applications, and more people have Google accounts than Flickr accounts.
Comment from keturn at February 10, 2006 12:46 PM
Where "anyone who wants to use it" means "people who want to give you write access to their Google Talk accounts"? That sounds like a Bad Idea. Am I missing something here?
Comment from Phil Windley at February 10, 2006 2:53 PM
Actually, Google has solved this problem, but using it would (I believe) require Google's cooperation. If you read the link to dystopics, you'll see a description of a token service (Kerberos like, although not Kerberos) that would mean that you could use tokens you get from logging into Google to authenticate at other sites.
Comment from nraynaud at February 14, 2006 6:38 AM
This was the purpose of passeport.net a few years ago ...
Comment from Phil Windley at February 14, 2006 6:44 AM
Indeed.
The noise about Passport may be one reason Google hasn't enabled this for Websites outside Google's control. If you try to redirect from the login to a non-Google domain, it won't let you. Changing that wouldn't take much more than a configuration change, I suspect.
Comment from Eliot Jacobsen at February 14, 2006 5:15 PM
an interesting cross-site authentication system from Verisign. Supported by eBay, Paypal and Yahoo. What do you think, Phil?
http://www.technewsworld.com/story/48850.html