I want to know whether OpenID protocol requires a direct connection from Relying Party to Identity Provider, because I'm concerned with a case when such a connection can be blocked.
What if I try to log in with this OpenID on a site which is run in Russia...
- Will it need to connect to the ID Provider directly and possibly fail because of censorship?
- Or the OpenID protocol can rely solely on communications done via the user agent (browser)?
from Wikipedia seems to imply that the user agent requests the "referral" letter from the ID Provider, and fetches it, and shows it to the Relying Party. (I can imagine that in order to be trusted, such a "referral letter" could be signed with a generally trusted SSL certificate owned by the ID Provider, so that it couldn't be forged by the user.)
But is that really true? In the beginnig of the Wikipedia article, it is said that:
First, the relying party and the OpenID provider (optionally) establish a shared secret, referenced by an associate handle, which the relying party then stores. If using the checkid_setup mode, the relying party redirects the end-user's user-agent to the OpenID provider so the end-user can authenticate directly with the OpenID provider.
Does this mean that a direct connection would still be needed?
(BTW, are there other similar protocols that avoid direct connections? By relying on signatures done with SSL certificates, for example.)
(Remark. Hopefully, no services are run on servers located in Russia, because as a service owner you must be a fool to submit to arbitrary Russia's censorship and server expropriation practices. So, the described situation must not arise, because it would be more clever to host any service outside of Russia.)