# Securing your Internal Organization with OpenID

DevFeed: [Securing your Internal Organization with OpenID](<https://devfeed.tech/articles/securing-your-internal-organization-with-openid-41108.md>)

Original publisher: [Read original article](<https://www.craigkerstiens.com/2012/01/23/Securing-your-Internal-Organization-with-OpenID/>)

Author: Map

Published: 2012-01-23T20:55:56Z

Content type: tutorial

Language: en

Sources: [Craig Kerstiens](<https://devfeed.tech/sources/craig-kerstiens.md>)

Topics: [openid](<https://devfeed.tech/topics/openid.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Django](<https://devfeed.tech/topics/django.md>), [Rails](<https://devfeed.tech/topics/rails.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>)

Tags: [business](<https://devfeed.tech/tags/business.md>), [database](<https://devfeed.tech/tags/database.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [openid](<https://devfeed.tech/tags/openid.md>), [password](<https://devfeed.tech/tags/password.md>), [startup](<https://devfeed.tech/tags/startup.md>), [vpn](<https://devfeed.tech/tags/vpn.md>)

## AI overview

The article explains how organizations can use OpenID and Google authentication to secure internal applications, documentation, wikis, and tools. It describes the domain setup required for OpenID discovery and provides Django and Rails examples, with mentions of Flask and Sinatra.

## Source excerpt

I've recently been amazed at the number of companies that are still using a VPN or other means to manage their apps/network. Not just large enterprisey companies, but small agile startups. I fully understand that it works, but 95% of these places are also using another key tool for access inside their company... Google Apps. I fully expect companies to use google apps, its more of the former that surprises me most. For a long time OpenID wasn't at a usable point, even today it still isn't without its faults. However, it does make for a much cleaner workflow once in place than having your users login to something with they're used to using elsewhere. In our personal lives we use email as our keys to the kingdom. In fact I now almost refuse to sign up for any service that doesn't let me use oauth, so why should a work place be much different. So I inquired with a few companies to see if they were fine with securing things like documentation or wiki's being google auth, they indeed were. Yet they still seem to have users keep one more username and password for their VPN to be able to login to access internal docs/tools. Most tech centric companies grow their own apps for many things they do within a company. Even the heavier adopters of SaaS still end up building a lot of internal systems. So why not secure them with your email domain just as you commonly would if it were a public service? The problem comes in that OpenId with google has an initial setup overhead, but after that works unbelievably well. The catch In some cases you currently have to identify your domain as an OpenId provider. This means that @yourname.com is an OpenId provider. This simply means creating a url route for openid in your base site similar to the below: <?xml version="1.0" encoding="UTF-8"?> <xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)"> <XRD> <Service priority="0"> <Type>http://specs.openid.net/auth/2.0/signon</Type> <URI>https://www.google.com/a/craigkerstiens.com/o8/ud?be