use openid as fallback so assertions always work