This is a validity check for the strategy, I don't think the presence of :username and :password make the authentication method invalid. Instead, change the order of policies - put the one relying on those params in front of :openid. Then you you can drop the check "(params[:username] || params[:password]).blank?".