Support update_url AX method to update profile data

Aron Novak - June 25, 2009 - 07:30
Project:OpenID Client AX
Version:6.x-6.x-dev
Component:Code
Category:task
Priority:normal
Assigned:Aron Novak
Status:needs work
Description

The update_url needs to be sent via the openid client (relying party) to the provider in the fetch request, then:
"If present, the OpenID Provider may re-post the fetch response
message to the specified URL at some time after the initial response
has been sent, using a OpenID Authentication Positive Assertion."
http://openid.net/pipermail/specs/2007-October/002014.html

The update of the values in uni-directional (provider -> relying party) according to the openid specs, the RP should be almost stateless (only caching), so the provider should have always the latest data. We cannot really ensure that the user cannot edit his profile on relying party side, or can we do that?

Things to do on the client side:

  • Provide a menu path for the update_url what identifies the user
  • Handle the incoming values, update the profile node

Sreg modules are not affected, no update mechanism is available for SReg values.

#1

Aron Novak - June 25, 2009 - 13:00

hook_openid_client() needs to be extended with an 'update' $op as well and update the saved node profile.
openid_client_ax needs to provide that callback url for the provider side.

#2

Aron Novak - June 29, 2009 - 14:05

Good summary here under "Asynchronous Attribute Updates":
http://blogs.gnome.org/jamesh/2007/11/26/openid-ax/

#3

Aron Novak - June 30, 2009 - 18:51
Status:active» needs work

First iteration of the patch. Untested.

AttachmentSize
openid_client_ax_update_url.patch 2.4 KB

#4

Aron Novak - June 30, 2009 - 18:51
 
 

Drupal is a registered trademark of Dries Buytaert.