OpenID SReg Optional vs Required

240 Views Asked by At

I was wondering if there was any real difference between requesting type as optional and required. I would think that if the authentication is successful but some of the required fields that have been requested are not available then there would be some sort of message to tell the RP.

Maybe there is such a message but I'm missing it. From what I can tell so far, if I request a valid type that has not been assigned a value (in myOpenID.com) as required then I get a successful authentication message but no data or message telling me that a required type is missing.

I'm using the openid-component for CakePHP which is a component built upon the JanRain/OpenID PHP Library.

Edit: I realize that I can just check if these types have been returned myself but I was more curious as to the difference in requesting them as optional or required when both results are (seemingly) identical.

1

There are 1 best solutions below

0
On BEST ANSWER

Marking the field as required or optional is only a suggestion to the provider.

As for the practical differences, for example Google ignores optional parameters completely. Some other providers tell users that the field is required, but allow to not send it anyway.

How it is interpreted depends on the provider completely. You don't get any information about required fields that aren't sent back (as it would be unreliable anyway).