I'm trying to add a way to query the data saved by the OpenID plugin from outside of ikiwiki, to see what identity the user has been authenticated as, if any. I'm thinking of designating some directories as internal pages and check the identity against a list in a mod_perl access hook. I would also write a CGI script that would return a JSON formatted reply to tell if the user is authenticated for those pages and query it with AJAX and only render links to the internal pages if the user would have access to them. That's just a couple of ideas I'm working on first, but I can imagine that there's any number of other tricks that people could implement with that sort of a thing.
Also, this isn't really specific to OpenID but to all auth plugins, but I'm going to use only OpenID for authentication so that's what I'm targeting right now. I suppose that would be worth its own TODO item. --[[kaol]]
+
+----
+
+So OpenID is dying, but OpenID connect is actually out there: Google is using it now, and probably other providers. There is interesting hybrid of OpenID and email auth called [Portier](https://portier.github.io) that is a successor to Persona that may be interesting here... The main problem here is that the broker is written in Rust and I am not sure we want to depend on such a thing in Ikiwiki. Still, the protocol could be used as a basis here... --[[anarcat]]