The purpose of the
Zend_OpenId component is to
implement the OpenID authentication protocol as described in the following
Authentication is initiated by the end user, who passes their OpenID identifier to the OpenID consumer through a User-Agent.
The OpenID consumer performs normalization and discovery on the user-supplied identifier. Through this process, the consumer obtains the claimed identifier, the URL of the OpenID provider and an OpenID protocol version.
The OpenID consumer establishes an optional association with the provider using Diffie-Hellman keys. As a result, both parties have a common "shared secret" that is used for signing and verification of the subsequent messages.
The OpenID consumer redirects the User-Agent to the URL of the OpenID provider with an OpenID authentication request.
The OpenID provider checks if the User-Agent is already authenticated and, if not, offers to do so.
The end user enters the required password.
The OpenID provider checks if it is allowed to pass the user identity to the given consumer, and asks the user if necessary.
The user allows or disallows passing his identity.
The OpenID Provider redirects the User-Agent back to the OpenID consumer with an "authentication approved" or "failed" request.
The OpenID consumer verifies the information received from the provider by using the shared secret it got in step 3 or by sending an additional direct request to the OpenID provider.