Migrating from Google OpenID 2.0 to OpenID Connect with different redirect_uri and openid.realm parameters

Vote count:

0

I am migrating from Google OpenID 2.0 to OpenID Connect. I am currently using Microsofts ACS which uses Googles depreciated OpenID 2.0 for authentication. This means my realm was automatically set to 'http://ift.tt/1nG5n0K'.

ACS has no plans to upgrade so I have begun integrating with Google OpenID Connect directly. I'm following Googles migration documentation which says I can add a openid.realm parameter (set as the realm used for OpenID 2.0) to then obtain the openid_id needed to map existing user accounts. Also it says the redirect_uri needs to be the same as the openid.realm. I guess for security reasons.

So my problem is I cannot set the redirect uri to the same as the realm because the realm is the ACS endpoint e.g.

http://ift.tt/1nG5ppp

I have tried setting them different but I get an error

'Realm didn't match redirect_uri/origin. Error code: 5'

Is Google planning to support cases like this?

Any ideas on ways to get around this?

asked 1 min ago

brocknz

11

Migrating from Google OpenID 2.0 to OpenID Connect with different redirect_uri and openid.realm parameters