Does AOL OpenID allow account authentication?

Question

When authenticating to any site (including stackoverflow) with AOL OpenID, you can specify any fake username on the form, and then enter a valid AOL username / password on the AOL OpenID site and the target website (e.g. stackoverflow) will say that authentication Successful, but with username FAKE.

My question is, should OpenID work, or is AOL doing something wrong, or am I just not understanding what is going on?

I came across this in my own project and after several hours of debugging I decided to see if I can reproduce it on a well-established site.

I went to stackoverflow, hit enter, clicked on the AOL logo, and entered the name asdf as the username. This led me to the AOL OpenID website, where I entered my true AOL username / password. Then I returned to stackoverflow, which said:

Confirm OpenID This OpenID does not have an account on Qaru yet: http://openid.aol.com/asdf Create New Account 

I clicked "Create" and now you have " http://openid.aol.com/asdf " in stackoverflow (sorry! I tried to delete it, but see how).

This is not true ... and in my application, it means that the identifier that I use for my users may be inaccurate / valid ... maybe even someone unscrupulous to come in, enter the username / url AOL OpenID AOL in the login field, authenticate using the AOL username / password and then access another account on the target website?

On OpenID vendor sites that return a unique identifier such as Google or Yahoo, this does not seem to be a problem.

Thanks for any suggestions ... it drives me crazy from my development efforts ...

Answer 1

Will you repeat the test? I believe the problem is resolved.

Answer 2

The intended side of OpenID (stackoverflow) must do the discovery in the ID you give it (asdf) in order to find the OpenID provider (AOL). Then, when you log into the provider’s system and send back the positive approval ID, the relying party must confirm that the claimed identifier in the statement matches the previously discovered information. This is how OpenID prevents spoofing. If stackoverflow uses the originally entered identifier instead of the identifier in the last statement without checking for conformity, this will be an error.

(I'm simplifying a bit, but that's the point. Read the specification for details, especially about delegation and the differences between the declared ID and the local identifier.)

Here is a site that will check this check:

http://www.test-id.net/RP/VerifyAssertionDiscovery.aspx

Here are some more tests:

http://www.test-id.net/

In addition, the provider is allowed to claim that any identifier in his own area belongs to you if he never claims that the same identifier belongs to someone else. This allows the provider to generate (on your behalf) a different identifier for each relying party you visit so that you cannot be tracked on multiple sites using the same identifier. This is a privacy feature (although I don’t know if any of the providers implement it).

Answer 3

This would be a (extremely serious) error in the AOL OpenID Provider. However, I just tried them and it did not work for me. Perhaps they fixed it. Can you try again?