_openid_provider_sign() tries to look up the assoc_handle in the database (openid_provider_association) but always fails to find it because no association (optional, according to the OpenID 2.0 spec) was created.

The provider code needs to always keep track of the shared secret in order to correctly sign messages.

Comments

Chris Johnson’s picture

Chris Johnson commented
Status: Active » Closed (won't fix)

Confused code. The no-association may or may not work, but what I was actually running into was a different bug which masqueraded as this problem.