Geek Answers Handbook

Almost all OpenId relying parties reject claims from my supported dotNetOpenAuth provider

Building an OpenId Provider, I ran into a curious problem that only Stack Exchange sites will accept.

Discovery is working fine and is looking at the traffic that I am sending (it seems to me) a valid response.

Miraculously, there are no conformity tests * to tell me what is wrong, and most sites that offer logins via OpenId give you useful error messages. The stack gives some, but it seems to be the only relying party that just accepts my claims, so ... yes.

Anyway, if I try to log in (for example) Typepad I will eventually redirect back to the URL, for example

https://www.typepad.com/secure/services/signin/openid?openid-check=1&archetype.quickreg=1&tos_locale=en_US&portal=typepad&oic.time=1303249620-9db5665031c9c6b36031&openid.claimed_id=https://example/user/8c481fb7-1b5c-4e50-86b5-xxxxxxxxx&openid.identity=https://example/user/8c481fb7-1b5c-4e50-86b5-xxxxxxxxx&openid.sig=hoaxQrsN4BBg6H8kp50NoQwpHmcO96BBe+jB3oOP2UA=&openid.signed=claimed_id,identity,assoc_handle,op_endpoint,return_to,response_nonce,ns.alias3,alias3.mode&openid.assoc_handle={634388464235195799}{oqMrOA==}{32}&openid.op_endpoint=https://example/openid/provider&openid.return_to=https://www.typepad.com/secure/services/signin/openid?openid-check=1&archetype.quickreg=1&tos_locale=en_US&portal=typepad&oic.time=1303249620-9db5665031c9c6b36031&openid.response_nonce=2011-04-19T21:47:03Z1aa4NZ48&openid.mode=id_res&openid.ns=http://specs.openid.net/auth/2.0&openid.ns.alias3=http://openid.net/srv/ax/1.0&openid.alias3.mode=fetch_response

() :

openid-check=1
archetype.quickreg=1
tos_locale=en_US
portal=typepad
oic.time=1303249620-9db5665031c9c6b36031
openid.claimed_id=https://example/user/8c481fb7-1b5c-4e50-86b5-xxxxxxxxx
openid.identity=https://example/user/8c481fb7-1b5c-4e50-86b5-xxxxxxxxx
openid.sig=hoaxQrsN4BBg6H8kp50NoQwpHmcO96BBe+jB3oOP2UA=
openid.signed=claimed_id,identity,assoc_handle,op_endpoint,return_to,response_nonce,ns.alias3,alias3.mode
openid.assoc_handle={634388464235195799}{oqMrOA==}{32}
openid.op_endpoint=https://example/openid/provider
openid.return_to=https://www.typepad.com/secure/services/signin/openid?openid-check=1
archetype.quickreg=1
tos_locale=en_US
portal=typepad
oic.time=1303249620-9db5665031c9c6b36031
openid.response_nonce=2011-04-19T21:47:03Z1aa4NZ48
openid.mode=id_res
openid.ns=http://specs.openid.net/auth/2.0
openid.ns.alias3=http://openid.net/srv/ax/1.0
openid.alias3.mode=fetch_response

XRDS ( ).

<?xml version="1.0" encoding="UTF-8"?>
<xrds:XRDS
xmlns:xrds="xri://$xrds"
xmlns:openid="http://openid.net/xmlns/1.0"
xmlns="xri://$xrd*($v*2.0)">
    <XRD>
      <Service priority="10">
        <Type>http://specs.openid.net/auth/2.0/signon</Type>
        <LocalID>https://example/user/8c481fb7-1b5c-4e50-86b5-xxxxxxxxx</LocalID>
        <Type>http://openid.net/extensions/sreg/1.1</Type>
        <Type>http://axschema.org/contact/email</Type>
        <URI>https://example/openid/provider</URI>
      </Service>

      <Service priority="20">
        <Type>http://openid.net/signon/1.0</Type>
        <Type>http://openid.net/extensions/sreg/1.1</Type>
        <Type>http://axschema.org/contact/email</Type>
        <URI>https://example/openid/provider</URI>
     </Service>
   </XRD>
</xrds:XRDS>

TypePad html,

<!-- Error Code: unexpected_url_redirect -->

... . , -.

MVC, dotNetOpenAuth, SendAssertion - , , .

protected ActionResult SendAssertion(IAuthenticationRequest authReq)
{
    // Not shown: redirect to a prompt if needed

    if (authReq.IsDirectedIdentity)
    {
        authReq.LocalIdentifier = Current.LoggedInUser.GetClaimedIdentifier();
    }
    if (!authReq.IsDelegatedIdentifier)
    {
        authReq.ClaimedIdentifier = authReq.LocalIdentifier;
    }

    authReq.IsAuthenticated = this.UserControlsIdentifier(authReq);

    if (authReq.IsAuthenticated.Value)
    {
        // User can setup an alias, but we don't actually want relying parties to store that since it can change over time
        authReq.ClaimedIdentifier = Current.LoggedInUser.GetClaimedIdentifier();
        authReq.LocalIdentifier = Current.LoggedInUser.GetClaimedIdentifier();

        // Not shown: responding to AX and SREG requests
    }

    var req = OpenIdProvider.PrepareResponse(authReq);
    var ret = req.AsActionResult();

    return ret;
}

, , , , - .

, , : ?

* , . "-, ".

+5
1

gotchas, dotNetOpenAuth.

  • SSL HTTP-, .
    • ... , HTTP- /,
  • HTML .
    • , , , HTML - .
  • OpenId 1.1 2.0
    • # 2, (OpenId 2.0), openid.server HTML.

dotNetOpenAuth OpenId, OpenId , , .

+1

More articles:


All Articles