title: Google OpenId Connect migration: getting the openid_id in ASP.NET app
body: <p>I've gone through plenty of Google documentation and SO Q/A's but with no luck. I wonder if anyone has yet succesfully used the OpenId to OpenId Connect migration as advised by Google.</p>
  
  <p>This is what we used to do:</p>
  
  <pre><code>IAuthenticationResponse response = _openid.GetResponse();
  if (response != null) {
     //omitted for brevity       
  } else {
     IAuthenticationRequest req = _openid.CreateRequest("https://www.google.com/accounts/o8/id");
     req.AddExtension(new ClaimsRequest
                      {
                          Country = DemandLevel.Request,
                          Email = DemandLevel.Request,
                          Gender = DemandLevel.Require,
                          PostalCode = DemandLevel.Require,
                          TimeZone = DemandLevel.Require
                      });
     req.RedirectToProvider();
  }
  </code></pre>
  
  <p>That was done using a version of DotNetOpenAuth that dates back a few years. Because Google has deprecated OpenId authentication we are trying to move over to OpenID Connect. The key question here is: can I somehow get my hands on the OpenId identifier (in the form of <a href="https://www.google.com/accounts/o8/id?id=xyz" rel="nofollow noreferrer">https://www.google.com/accounts/o8/id?id=xyz</a>) using the latest version of DotNetOpenAuth library or by any other means?</p>
  
  <p>I have tried the latest DotNetOpenAuth and I can get it to work but it gives me a new Id (this was expected). I have also tried the Javascript way by using this URL (line breaks for readibility):</p>
  
  <pre><code>https://accounts.google.com/o/oauth2/auth?
      scope=openid%20profile%20email
      &amp;openid.realm=http://localhost/palkkac/
      &amp;client_id=//here is the client id I created in google developer console
      &amp;redirect_uri=http://localhost/palkkac/someaspxpagehere
      &amp;response_type=id_token%20token
  </code></pre>
  
  <p>I checked (using Fiddler) the realm value that we currently send using the old DotNetOpenAuth code and it is <code>http://localhost/palkkac/</code>. I've put the same realm in the url above. The redirect url <strong>starts</strong> with the realm value but it is not entirely the same.</p>
  
  <p>When I redirect to a simple page that parses the id_token and decrypts it (using the <code>https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=zyx</code> endpoint) I get this:</p>
  
  <pre><code>audience    "client id is here"
  email   "mikkark@gmail.com"
  expires_in  3597
  issued_at   //some numbers here
  issued_to   "client id is here"
  issuer  "accounts.google.com"
  user_id     "here is a sequence of numbers, my id in the OpenID Connect format that is"
  verified_email  true
  </code></pre>
  
  <p>So there is no sign of the openid_id field that you would expect to find here, though the whole structure of the message seems different from the Google docs, there is no field titled sub, for example. I wonder if I'm actually using the wrong endpoint, parameters or something?</p>
  
  <p>What I have been reading is the migration guide: <code>https://developers.google.com/accounts/docs/OpenID</code>. I skipped step 2 because it seemed like an optional step. In step 3 the field openid_id is discussed and I would like to get that to work as a proof-of-concept first.</p>
  
  <p>We registered the app on Google in order to create the client id etc. There are now also numerous allowed redirect url's as well as javascript origins listed in the Google dev console. Let me know if those might mess up the system and I'll post them here for review.</p>
  
  <p>Side note: we are supposed to be moving our app behind a strictly firewalled environment where we would need to open ports in order to do this on the server side. Therefore, a client-side Javascript solution to access Google combined with HTTPS and redirecting the result to the server would be prefered (unless there are other issues that speak against this).</p>
  
  <p>There are other resources on SO regarding this same issue, although all of these seem to use different libraries on the server side to do the job and nobody seems to have made any attempts at using Javascript:</p>
  
  <ul>
  <li>Here (<code>https://stackoverflow.com/questions/22842475/migrating-google-openid-to-openid-connect-openid-id-does-not-match</code>) I think the problem was resolved by setting the realm to be the same as in the old OpenId2.0 flow. This does not seem to work in my case.</li>
  <li>over <a href="https://stackoverflow.com/questions/22481908/migrating-from-google-openid-to-new-oauth-2?rq=1">here</a> the openid_id field is also missing, but the problem here is more about how to request the id_token from Google using libraries other than DotNetOpenAuth.</li>
  <li>and in <a href="https://stackoverflow.com/questions/25568187/asp-net-identity-google-account-id-migration-from-openid-to-oauth">here</a> there seem to be similar problems getting Google to return the openid_id field.</li>
  </ul>