Fallback-account-access


Given that OpenID providers can occasionally go down (or out of business!), it's important to consider fallback mechanisms for OpenID users to prevent account lock out.

Relying Party Techniques

Email fallback

37Signals' Basecamp service currently allows association of a confirmed email address with an account in case an OpenID provider is either unavailable or a user cannot recall her OpenID.

The user enters the email address and a one-time access token link is provided via email enabling the user to access her account, reset her OpenID provider or switch to legacy authentication.

Alternate OpenID fallback

Ma.gnolia affords user the ability to associate multiple identifiers and OpenIDs with his account.

Any of these identifiers can be used to subsequently gain access to his account.

User techniques

Multiple-delegation fallback

In the case of a delegated OpenID, a user can specify one or more OpenID providers in her XRDS profile prioritized according to preference. This method works well in case preferred providers go down or are otherwise unavailable.