=== modified file 'sites/all/modules/openid_provider/openid_provider.module'
--- sites/all/modules/openid_provider/openid_provider.module	2010-08-12 13:20:06 +0000
+++ sites/all/modules/openid_provider/openid_provider.module	2010-08-12 23:13:16 +0000
@@ -39,12 +39,14 @@ function openid_provider_menu() {
     'type' => MENU_CALLBACK,
     'file' => 'openid_provider.pages.inc'
   );
+  // Below evaluates to 'user/%user/identity'
   $items[openid_provider_user_path('%user')] = array(
     'title' => 'OpenID Page',
     'page callback' => 'openid_provider_page',
     'page arguments' => array(1),
-    'description' => 'Menu callback with full access so no forbiddens are given from server requests',
-    'access callback' => TRUE,
+    // This passes the loaded user object to user_access(): access
+    // depends on the rights of the visited account, not on the current user.
+    'access arguments' => array('use openid provider', 1),
     'type' => MENU_CALLBACK,
     'file' => 'openid_provider.pages.inc'
   );
@@ -64,7 +66,7 @@ function openid_provider_menu() {
  * Implementation of hook_perm().
  */
 function openid_provider_perm() {
-  return array('administer openid provider');
+  return array('use openid provider', 'manage own openid sites', 'administer openid provider');
 }
 
  /**
@@ -96,7 +98,8 @@ function openid_provider_init() {
  */
 function openid_provider_sites_access($account) {
   global $user;
-  return ($account->uid == $user->uid) || user_access('administer openid provider');
+  return ($account->uid == $user->uid && user_access('use openid provider')
+    && user_access('manage own openid sites')) || user_access('administer openid provider');
 }
 
 /**