Download & Extend

OpenID spec violation. Extract Authentication data - *search* for OP Identifier element

Project:Drupal core
Version:7.x-dev
Component:openid.module
Category:bug report
Priority:normal
Assigned:Unassigned
Status:closed (fixed)

Issue Summary

OpenID 2.0 Authentication 7.3.2.2. Extracting Authentication Data:

Once the Relying Party has obtained an XRDS document, it MUST first search the document (following the rules described in [XRI_Resolution_2.0]) for an OP Identifier Element. If none is found, the RP will search for a Claimed Identifier Element.

SO:

First, Drupal should search throught the XRDS document, trying to find whether it contains an OP Identifier element which is a Service element, containing a Type tag with the text content "http://specs.openid.net/auth/2.0/server" and a URI tag (the text content is the OP endpoint URL Drupal must use to do authentication requests).

If Drupal cannot find this OP Identifier element, it should try to find a Claimed Identifier Element which is a Service element, containing a Type tag with the text content http://specs.openid.net/auth/2.0/signon", a URI tag (containing the OP endpoint URL as above) and an optional LocalID tag (an identifier used by the OpenID provider to identify the user).

This issue is brought to you by the OpenID 2.0 Compliance Crusade

Comments

#1

subscribe

#2

Status:active» needs review

This patch searches for the two different service elements as described in the OpenID spec. It also adds support for the priority attribute for the Service element as described in the XRI spec, section 4.3.3.

In openid_complete() the verification no longer uses $services[0] but loops through all discovered services. Section 11.2 of the spec says:

If the Claimed Identifier was not previously discovered by the Relying Party (the "openid.identity" in the request was "http://specs.openid.net/auth/2.0/identifier_select" or a different Identifier, or if the OP is sending an unsolicited positive assertion), the Relying Party MUST perform discovery on the Claimed Identifier in the response to make sure that the OP is authorized to make assertions about the Claimed Identifier.

I'm not completely sure how this is done. For now I look for service elements with the type either http://specs.openid.net/auth/2.0/signon or http://specs.openid.net/auth/2.0/server.

AttachmentSizeStatusTest resultOperations
openid-xrds-1.patch19.77 KBIdleFailed on MySQL 5.0 InnoDB, with: 17,335 pass(es), 1 fail(s), and 0 exception(es).View details

#3

Status:needs review» needs work

The last submitted patch, openid-xrds-1.patch, failed testing.

#4

Hmm, I cannot reproduce the test failure reported by the test bot. I'll take a look at this later.

#5

Status:needs work» needs review

The problem reported by the test bot occurred when Drupal is installed in a subdirectory.

AttachmentSizeStatusTest resultOperations
openid-xrds-2.patch20.18 KBIdlePassed on all environments.View details

#6

Reroll.

AttachmentSizeStatusTest resultOperations
openid-xrds-3.patch19.9 KBIdleFAILED: [[SimpleTest]]: [MySQL] Unable to apply patch openid-xrds-3.patch.View details

#7

Status:needs review» fixed

Committed to CVS HEAD. Thanks!

#8

Status:fixed» closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.