If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct openID login server?
For use by consumers, I believe you should be ok, but for use by employee's you'd potentially run afoul of PCI-DSS requirement 8.5. OpenID provides an authentication mechanism independent of data and validates a user matches with the unique ID assigned to the user within your system. For non-consumer users there are additional requirements for password complexity and changes that might not be enforced by a third party OpenID system, however for the consumer users (whose information is being protected), it seems to be allowable to let them use an OpenID to authenticate.