Right now, when the user removes the GWT/App Engine nature from the project, if they have a SDK container on their build path, it is collapsed into its individual jars, and they are added to the classpath. In some cases, users do not expect this behavior (for example, if they mistakingly added the wrong nature).
Yes, you will need to use the federated login (OpenID) stuff. The long-and-short of it is that you pass the federated_identity parameter to users.create_login_url. You'll need to setup a page for users to tell you what goes in federated_identity somehow, perhaps by clicking a google logo or entering an apps domain. For Google accounts: users.create_login_url(federated_identity='google.com/accounts/o8/id') or users.create_login_url(federated_identity='gmail.com') For an Apps account: users.create_login_url(federated_identity='google.com/accounts/o8/site-xrds?hd=yourappsdomain.com') There is a little info here: http://code.google.com/appengine/docs/python/users/overview.html And Wesley has a nice article about it here: http://code.google.com/appengine/articles/openid.html Some info on Google Apps domains and OpenID: http://groups.google.com/group/google-federated-login-api/web/openid-...