# Open\_id\_authentication and remember\_me

**URL:** <https://www.ruby-forum.com/t/open-id-authentication-and-remember-me/138981>\
**Category:** Rails\
**Created:** [May 29, 2008, 6:43pm UTC](https://www.ruby-forum.com/t/open-id-authentication-and-remember-me/138981 "2008-05-29T18:43:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![evensoul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e9c0ed/32.png) [@evensoul](https://www.ruby-forum.com/u/evensoul)\
**Post date:** [May 29, 2008, 6:43pm UTC](https://www.ruby-forum.com/t/open-id-authentication-and-remember-me/138981/1 "2008-05-29T18:43:32Z")

</div>

Hi,  
I’ve got a user login system working by combining the  
restful\_authentication  
with open\_id\_authentication plugins. But there’s a little problem, and  
that is that  
any additional parameters from the login form (such as remember\_me)  
are lost after the OpenID transaction, and I don’t see how to pass it  
around  
as an option somewhere either. For instance, in SessionsController:

# remember\_me is passed from #create

def open\_id\_authentication(openid\_url, remember\_me)  
authenticate\_with\_open\_id(openid\_url, :required =\>  
[:nickname, :email]) do |result, identity\_url, registration|  
if result.successful?  
@user = User.find\_or\_initialize\_by\_identity\_url(identity\_url)  
# …set @user fields…  
self.current\_user = @user  
successful\_login(remember\_me) # when initiated from the GET  
call to SessionsController#create after the authentication this is nil  
end  
end  
end

Has anyone solved this?

```
Marko
```

---

<div class="post-metadata">

**Author:** ![evensoul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e9c0ed/32.png) [@evensoul](https://www.ruby-forum.com/u/evensoul)\
**Post date:** [May 29, 2008, 7:06pm UTC](https://www.ruby-forum.com/t/open-id-authentication-and-remember-me/138981/2 "2008-05-29T19:06:24Z")

</div>

> I’ve got a user login system working by combining the  
> restful\_authentication  
> with open\_id\_authentication plugins. But there’s a little problem, and  
> that is that  
> any additional parameters from the login form (such as remember\_me)  
> are lost after the OpenID transaction, and I don’t see how to pass it  
> around  
> as an option somewhere either. For instance, in SessionsController:

FYI, best practice for OpenID relying parties is that the remember-me  
functionality is left to the identity provider, not the relying party.  
That allows an OpenID user to revoke all his remember-me’s at once if,  
for example, his password is compromised.

In this scenario, what you need to do as a relying party is simply  
remember the OpenID identifier that a user last authenticated with,  
then, when he returns, do a checkid\_immediate with the identity  
provider, using that OpenID identifier. If the user has enabled  
remember-me for your site, the checkid\_immediate call will succeed, and  
you can consider that user authenticated.

- D

---

<div class="post-metadata">

**Author:** ![evensoul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e9c0ed/32.png) [@evensoul](https://www.ruby-forum.com/u/evensoul)\
**Post date:** [May 30, 2008, 8:51pm UTC](https://www.ruby-forum.com/t/open-id-authentication-and-remember-me/138981/3 "2008-05-30T20:51:29Z")

</div>

On May 29, 7:06 pm, Danny B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> functionality is left to the identity provider, not the relying party.  
> That allows an OpenID user to revoke all his remember-me’s at once if,  
> for example, his password is compromised.
> 
> In this scenario, what you need to do as a relying party is simply  
> remember the OpenID identifier that a user last authenticated with,  
> then, when he returns, do a checkid\_immediate with the identity  
> provider, using that OpenID identifier. If the user has enabled  
> remember-me for your site, the checkid\_immediate call will succeed, and  
> you can consider that user authenticated.

Thanks for pointing me in the right direction. I’ll get back to this  
a bit later. It seems like I’ll need to modify the plugin or use  
ruby-openid directly in order to be able to do a checkid\_immediate  
authentication call.

```
Marko

```