Hi,

I'm in the process of implementing OpenID sign in, which turns out to
be quite straight forward, but have run into one issue in the way
sessions work. The OpenID process requires 2 URLs on the site to be
accessed, the first to present the form to collect an OpenID
identifier and the second to handle the response from the provider of
that identifier. During this the OpenID library wants to maintain
some values in a session for the user trying the access. Currently I
can't see how to cleanly get a persistent session only identified by
a cookie without a user being authenticated.

Any ideas on how I could do this? Also in this case there is a need
for some session data to be stored, what is the usual way for that to
be done?

Peter Wilkinson
pw@thirdfloor.com.au