3

I am currently using federated authentication via openid in appengine - using google, yahoo, myopenid as the providers

Had a question as to what I should be storing in my db to identify returning users. I am currently storing user.getNickname() - (for google and yahoo this returns the users email address).

User user = userService.getCurrentUser();
String username = user.getNickname();

I use this to store and retrieve user specific data.

Is this the right way to proceed? Is the getNickName() unique? I see that User also has a user.getUserId() method and a user.getEmailId() method.

should I be using user.getUserId() instead?

user275157
  • 1,332
  • 4
  • 23
  • 45

1 Answers1

4

  1. getNickname() - don't use this.

  2. getUserId() - this is logical, but the problem could be if users forget which identity they used with your site (I have multiple accounts with google, plus yahoo and facebook). This could lead to creating multiple account for one person. But then, some people want this. Also, this remains the same for Google users even if they change their email.

  3. 'getEmail()` - is actually similar to ID - uniquely identifies user. CAN be different then ID if users use alias email to log in.

Anyhow, when users log in for the first time you should present them with Account Details page (like SO does). Also, you should give users ability to aggregate identities into one account.

Peter Knego
  • 79,991
  • 11
  • 123
  • 154
  • 1
    Don't use `getEmail` - it's provided by the OpenID provider, but it's not guaranteed to be accurate. Any user can claim any email address. – Nick Johnson Mar 07 '11 at 23:20
  • Thanks Peter/Nick. I have decided to go ahead and use getUserId() and assume that if users could (sometimes accidentally) create two accounts. – user275157 Mar 08 '11 at 02:54