2

I'm designing a new web application. Some quick points on it:

  • ASP.NET MVC Web Application
  • SQL Server 2008
  • Entity Framework ORM
  • 3 User Roles: Anonymous, Registered, Administrators.
  • Anonymous users can view stuff, Registered Users can post stuff, Admins can do anything
  • Heavy social integration with Facebook, Twitter and the like.
  • I plan to use OpenId for authentication (DotNetOpenAuth)

So, pretty simple right? (famous last words)

Now my question is:

Should i provide OpenId as the only means of authentication, or should i also give the user the option to log in using my own authentication system?

So this is basically a "User Experience" question. Take the example of StackOverflow - you MUST signup with OpenId. It seemed fine to me, but what about the general public? Can i be happy with the fact that a user of my site must have an OpenId account? (or signup for one before using my site)

Is giving the user two options to login bad UX?

I realize this is a partially subjective question, but im just looking for advice on which road to take, some case studies would be helpful.

Thanks.

RPM1984
  • 72,246
  • 58
  • 225
  • 350

2 Answers2

2

Any good answer to a subjective question begins with it depends. :-)

I think if your prospective user base is already fairly social-network engaged (as it sounds by your description), it will probably be just fine to have authentication handled by OpenId providers. The important part is providing an easy-to-use login process, and make it obvious that various providers are available for authentication (Yahoo, Google, etc.).

If your prospective user base is going to consist of new or inexperienced Internet users, even a simple OpenId implementation may be too confusing.

I, for one, find it annoying to have to create yet another account every time a visit a new website, and I suspect that more and more users are feeling the same way.

There's a decent set of responses to a similar question at https://ux.stackexchange.com/questions/78

Community
  • 1
  • 1
Eric King
  • 11,594
  • 5
  • 43
  • 53
  • Exactly the answer i was looking for, thanks (+1). I'll also be providing a "Facebook Connect" button. I'll stick with just OpenId. But can i still grab info about the user? My "user" entity will only care about things like name, location, age, etc. When they "signin" with OpenId - does OpenId give me that info? Also - did not even know about ui.stackexchange.com - awesome! =) – RPM1984 Sep 10 '10 at 04:11
  • What information you get back from the OpenId provider depends on the provider and the user. You can ask for it in your authentication request, but you may not get it (the user is informed of the information request and can deny it, even while authenticating successfully). – Eric King Sep 10 '10 at 04:34
  • @Eric King - cool, so just like Facebook Connect. (deny/allow info, perms). Thanks dude! – RPM1984 Sep 10 '10 at 04:43
  • I'll throw in there that Janrain's research suggests that offering a hybrid login (username+password OR OpenID) gets *worse* login rates than just having one or the other. – Andrew Arnott Sep 11 '10 at 02:46
  • @Andrew, @Eric King - as can i. However this is a social website, which heavily relies on FB, Twitter, etc. Therefore i will need at LEAST a facebook/twitter login. So its just a matter of whether in addition to a fb/twitter login, do i provide openid/custom or both. tough one. im leaning towards no openid now, as not enough ppl know about it. i can always add it later, but a custom system cant really be added later. – RPM1984 Sep 14 '10 at 04:30
  • @RPM1984, you may find this question worthwhile to read my answer to (http://stackoverflow.com/questions/1316983/to-openid-or-not-to-openid-is-it-worth-it/1317446#1317446). Particularly the part about offering OpenID but not telling the user that's what it is. You can capture the best of both worlds (FB + OpenID) while not sacrificing usability IMO. – Andrew Arnott Sep 14 '10 at 14:30
  • @Andrew - an interesting answer, something i will definetely take into consideration/prototype/research. Thanks, +1 – RPM1984 Sep 14 '10 at 21:54
0

The thing is that only OpenID won't cut it in you case mainly because of Facebook and Twitter who aren't OpenID providers. Both use OAuth 2 for authetication. Wikipedia says this about it:

OAuth (Open Authorization) is an open standard for authorization. It allows users to share their private resources (e.g. photos, videos, contact lists) stored on one site with another site without having to hand out their credentials, typically username and password.

and this:

OAuth is a service that is complementary to, but distinct from, OpenID.

The DotNetOpenAuth also supports OAuth and the latest CTP release implements the OAuth 2 draft 10. Mind you that the OAuth 2 specification is still being developed and is expected to be finalized by the end of 2010. OAuth 2 also isn't backward compatible with OAuth 1.

gligoran
  • 3,267
  • 3
  • 32
  • 47