the issue here is, that openid_identifier is the value you put in the form and it isn't unique in all cases:  for google  eg. it is  always https://www.google.com/accounts/o8/id..

$_SESSION['openid']['openid_uri'] is set within the openid auth proceess, it is a GET value with the claimed openID returned from the openID provider. This one is always uniqe.

I was tempted to remove $_POST['openid_identifier'] completely from that part but left it as fallback.