openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java
@Override
	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException, IOException {
		OpenIDAuthenticationToken token;

		String identity = request.getParameter("openid.identity");

		if (!StringUtils.hasText(identity)) {
			String claimedIdentity = obtainUsername(request);

			try {
				String returnToUrl = buildReturnToUrl(request);
				String realm = lookupRealm(returnToUrl);
				String openIdUrl = consumer.beginConsumption(request, claimedIdentity,
						returnToUrl, realm);
				if (logger.isDebugEnabled()) {
					logger.debug("return_to is '" + returnToUrl + "', realm is '" + realm
							+ "'");
					logger.debug("Redirecting to " + openIdUrl);
				}
				response.sendRedirect(openIdUrl);

				// Indicate to parent class that authentication is continuing.
				return null;
			}
			catch (OpenIDConsumerException e) {
				logger.debug("Failed to consume claimedIdentity: " + claimedIdentity, e);
				throw new AuthenticationServiceException(
						"Unable to process claimed identity '" + claimedIdentity + "'");
			}
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Supplied OpenID identity is " + identity);
		}

		try {
			token = consumer.endConsumption(request);
		}
		catch (OpenIDConsumerException oice) {
			throw new AuthenticationServiceException("Consumer error", oice);
		}

		token.setDetails(authenticationDetailsSource.buildDetails(request));

		// delegate to the authentication provider
		Authentication authentication = this.getAuthenticationManager().authenticate(
				token);

		return authentication;
	}
@Override
	public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException, IOException {
		OpenIDAuthenticationToken token;

		String identity = request.getParameter("openid.identity");

		if (!StringUtils.hasText(identity)) {
			String claimedIdentity = obtainUsername(request);

			try {
				String returnToUrl = buildReturnToUrl(request);
				String realm = lookupRealm(returnToUrl);
				String openIdUrl = consumer.beginConsumption(request, claimedIdentity,
						returnToUrl, realm);
				if (logger.isDebugEnabled()) {
					logger.debug("return_to is '" + returnToUrl + "', realm is '" + realm
							+ "'");
					logger.debug("Redirecting to " + openIdUrl);
				}
				response.sendRedirect(openIdUrl);

				// Indicate to parent class that authentication is continuing.
				return null;
			}
			catch (OpenIDConsumerException e) {
				logger.debug("Failed to consume claimedIdentity: " + claimedIdentity, e);
				throw new AuthenticationServiceException(
						"Unable to process claimed identity '" + claimedIdentity + "'");
			}
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Supplied OpenID identity is " + identity);
		}

		try {
			token = consumer.endConsumption(request);
		}
		catch (OpenIDConsumerException oice) {
			throw new AuthenticationServiceException("Consumer error", oice);
		}

		token.setDetails(authenticationDetailsSource.buildDetails(request));

		// delegate to the authentication provider
		Authentication authentication = this.getAuthenticationManager().authenticate(
				token);

		return authentication;
	}
Authentication has two phases.
<ol>
<li>The initial submission of the claimed OpenID. A redirect to the URL returned
from the consumer will be performed and null will be returned.</li>
<li>The redirection from the OpenID server to the return_to URL, once it has
authenticated the user</li>
</ol>