I'm in charge of IT at a students' organization. Let's call it
FratA has ties to sister-organizations in other university cities in my country. Let's call those
FratZ. These inter-organizational ties are formalized by an umbrella organization, of which
FratZ are members. Let's call it
SuperFrat is planning an event for all the student members of
FratZ, and wants to sell tickets to the event using a web store provided by
However, the sale of tickets should be limited to members of the organizations
TicketSellingCorp has approached me with an unusual inquiry:
We want users to type in their username and password to the FratA-website, so our web store can log in behind the scenes, scrape their personal/contact information from their normally protected profile page and use this information for ticket sales. Don't worry about security, we won't store passwords, and our backups are encrypted.
The main problem is that once logged in, our members can not only access their own information, but also a lot of information about other people.
So if member Alice does not agree with
TicketSellingCorp's proposed implementation, her information would still be exposed to
TicketSellingCorp if Bob does agree.
TicketSellingCorp that I think this is a bad idea that conflicts our members' interests, and I offered them an openID provider (including an OSS sample client implementation) for the
FratA-website; one that only tells the openID client that authentication was successful or not. It does not even share any information, such as an email address.
My motivation for that is that
TicketSellingCorp can ask users for that themselves, so users are responsible for sharing their own information.
TicketSellingCorp's response to this was:
We cannot implement openID in our sales process.
Is there another way to cooperate with
TicketSellingCorp that does not involve exposing all our members' personal information?