OpenID Provider on Local Host with DotNetOpenAuth

Question

I have an example of a DotNetOpenAuth provider working locally, and it seems to handle requests correctly through a web browser. I can go through the handler for authorization in the debugger.

I have a project that can be authenticated using Google and other providers, but does not work with the sample provider. The fetch provider never sees the request at all, and the relying party throws a complaint about the No OpenID endpoint found. exception No OpenID endpoint found.

Let's say I do the following on the relying side:

 string providerURL = "http://localhost/openid/provider"; // Now try the openid relying party... var openid = new OpenIdRelyingParty(); var response = openid.GetResponse(); if (response == null) { Identifier id; if (Identifier.TryParse(providerURL, out id)) { // The following line throws the exception without ever making // a request to the server. var req = openid.CreateRequest(providerURL); // Would redirect here... } } 

I noticed that the UntrustedWebRequestHandler class prevents connections to host names such as localhost , but adding it as a whitelisted host according to test cases or manually does not help.

I checked that the host is accessible:

 // Check to make sure the provider URL is reachable. // These requests are handled by the provider. HttpWebRequest request = (HttpWebRequest)WebRequest.Create(providerURL); HttpWebResponse httpRes = (HttpWebResponse)request.GetResponse(); 

Thoughts? I am finally about why he never makes a request at all.

EDIT: localhost was turned on as white:

 (openid.Channel.WebRequestHandler as UntrustedWebRequestHandler).WhitelistHosts.Add("localhost"); 

I also tried reinstalling it by adding it to web.config as follows:

 <dotNetOpenAuth> <messaging> <untrustedWebRequest> <whitelistHosts> <add name="localhost"/> </whitelistHosts> </untrustedWebRequest> </messaging> </dotNetOpenAuth> 

Using any approach, localhost appears in the UntrustedWebRequestHandler list of white hosts when checking in the debugger. Their provider still does not receive any requests.

Answer 1

It looks like you already know the need to use the localhost whitelist for RP to make it work. But recently, I found out that IIS blocks ASP.NET web applications from doing HTTP GET on themselves. It works for the personal web server of Visual Studio, but if your RP and OP are hosted in IIS under localhost , most likely it is IIS blocking it. You can confirm or deny this using your manual HttpWebRequest tag from your IIS-enabled RPI and console application.

If both of them are in IIS and that is the problem, then you should either use a personal web server for your development, or perhaps separate the two sites from IIS in different application pools, or something similar will help.