We recently realized that OpenID AX is not working anymore in our setup with a D6 openid_provider(_ax) and D7 OpenID clients, and I tracked down the cause to the following:

- the D7 OpenID client picks one of the offered services from the service list (and only from the services which have a URI)
- then the rest of the services are dropped and not used for the request
- the AX request pieces are only sent if the service supported AX

However, the openid_provider_ax() module exposes a new XRDS service rather than modifying the openid_provider service itself and openid_provider_ax does not specify an endpoint URI so its service is never selected. Which means that a D7 client will never use AX with openid_provider(_ax). I think there are two possible solutions to follow:

1. Either introduce a new hook in the openid_provider XRDS hook implementation to be able to modify that service and then use that hook in openid_provider_ax.
2. Recite the openid_provider service details in openid_provider_ax in the returned service and set a more important (lower number) priority, so this one is selected by the client.

The attached patch implements 2 to avoid the need to patch 2 modules in concert. 1 is an equally viable solution to the problem.

With the attached patch, both services (returned by openid_provider and openid_provider_ax) will return an endpoint URI and the _ax one will also return the AX service type and set itself to be of higher importance, so is expected to be selected by the client. Then the client will send AX-covering requests and the module can actually respond with AX values.

CommentFileSizeAuthor
openid_provider_ax-xrds-fix.patch1012 bytesgábor hojtsy

Comments

xamanu’s picture

Version: 6.x-1.x-dev » 7.x-1.x-dev
Status: Needs review » Fixed

Thank you Gábor! Committed to 6.x-1.x and minimally ported to 7.x-1.x branch.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.