Is it valid to have an IP address as OpenID?
Most OpenID libraries require you to input a domain name as OpenID. Is it valid / possible to have an IP address like 198.51.100.1
as OpenID instead of auth.example.com
?
I'm assuming that when you said "as OpenID" you meant "as User Supplied OpenID Identifier".
If so then answering as short as possible: Yes, but it's not best idea to do so.
Long answer: OpenID 2.0 specs defines that User Supplied OpenID Identifier should be valid XRI or URI [1], so entering http://1.2.3.4/ should result in valid normalization, discovery and authentication, as IP in URI is considered a valid URL as far as RFC3986 [2] goes.
That said you have to consider few things:
- IP addresses change, you might claim that this is solid, but it's not (e.g. in some future you will have to switch to IPv6 and then you will loose access to all sites you were authenticated using such IP OpenID with). With domain based OpenID all you have to do is point your domain to new IP.
- Sites offering OpenID (relying parties) perform OpenID Identifier validation before normalization. Sooner or later you will stumble upon one that won't validate IP as valid OpenID Identifier.
References:
- http://openid.net/specs/openid-authentication-2_0.html#normalization
- http://www.ietf.org/rfc/rfc3986.txt
精彩评论