When an RP requests an association with session type "no-encryption" then future RP requests for checkid_setup or checkid_immediate for the same association fail with signature mismatch.

Hint: 4.7 code fails the same way.

Comments

Chris Johnson’s picture

Chris Johnson commented
Assigned: Unassigned » Chris Johnson
Status: Active » Reviewed & tested by the community

Here's the fix:

Index: /trunk/drupal/6/modules/openid_provider/openid_provider.inc
===================================================================
--- /trunk/drupal/6/modules/openid_provider/openid_provider.inc (revision 6654)
+++ /trunk/drupal/6/modules/openid_provider/openid_provider.inc (revision 6967)
@@ -44,5 +44,5 @@
$secret = _openid_get_bytes($num_bytes);
if ($session_type == '' || $session_type == 'no-encryption') {
- $mac_key = hash_hmac($algo, $response['assoc_handle'], $secret, true);
+ $mac_key = base64_encode(hash_hmac($algo, $response['assoc_handle'], $secret, true));
$response['mac_key'] = $mac_key;
}

walkah’s picture

walkah commented
Status: Reviewed & tested by the community » Fixed

committed, thanks :-)

wundo’s picture

wundo commented
Status: Fixed » Closed (fixed)
Issue tags: +dc2009 code sprint
wundo’s picture

wundo commented
Status: Closed (fixed) » Fixed

Status: Fixed » Closed (fixed)
Issue tags: -dc2009 code sprint

Automatically closed -- issue fixed for 2 weeks with no activity.

Issue tags: +dc2009 code sprint

Restoring issue tags, see #2125755: System messages removed all issue tags during D7 upgrade.