associate requests with session type "no-encryption" fail
Chris Johnson - November 11, 2008 - 03:37
| Project: | OpenID Provider |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Chris Johnson |
| Status: | closed |
| Issue tags: | dc2009 code sprint |
Jump to:
Description
When an RP requests an association with session type "no-encryption" then future RP requests for checkid_setup or checkid_immediate for the same association fail with signature mismatch.
Hint: 4.7 code fails the same way.
#1
Here's the fix:
Index: /trunk/drupal/6/modules/openid_provider/openid_provider.inc
===================================================================
--- /trunk/drupal/6/modules/openid_provider/openid_provider.inc (revision 6654)
+++ /trunk/drupal/6/modules/openid_provider/openid_provider.inc (revision 6967)
@@ -44,5 +44,5 @@
$secret = _openid_get_bytes($num_bytes);
if ($session_type == '' || $session_type == 'no-encryption') {
- $mac_key = hash_hmac($algo, $response['assoc_handle'], $secret, true);
+ $mac_key = base64_encode(hash_hmac($algo, $response['assoc_handle'], $secret, true));
$response['mac_key'] = $mac_key;
}
#2
committed, thanks :-)
#3
#4
#5
Automatically closed -- issue fixed for 2 weeks with no activity.