I can log in to drupal using my goolge openid, but it fails on my own Community-ID openid with the message:
"Sorry, that is not a valid OpenID. Please ensure you have spelled your ID correctly."

I ensured there are no spelling errors in it.

My OpenID works on other OpenId enabled sites including my own PHP application using Janrain libraries.
I disabled and enabled SSL to exclude this as a root cause.

CommentFileSizeAuthor
#7 do-955432-openid-html-delegation.patch820 bytesheine

Comments

nocturn’s picture

nocturn commented

Also reported in community-id: http://source.keyboard-monkeys.org/issues/show/277

heine’s picture

heine commented
Status: Active » Postponed (maintainer needs more info)

Can you give us an account on the Community-ID server + steps to reproduce to debug this?

What does "I disabled and enabled SSL to exclude this as a root cause" exactly mean?

nocturn’s picture

nocturn commented

My mistake, the Drupal-provider module does work.

nocturn’s picture

nocturn commented

No problem, please send me a mail to nocturn00 AT gmail DOT com and I'll reply with credentials to the account.

The SSL comment means that you can set up CommunityID to upgrade to SSL on operations like the login screen, I tried with both settings and the result is always the same.

Steps to reproduce:
- Prerequisites: A community-Id account and a Drupal account
- Log into drupal
- Go to My Account
- Click OpenID identities and add the URL from CommunityID
- Result: you get the error above instead of seeing the ID added

heine’s picture

heine commented

Thanks. I've send the mail.

heine’s picture

heine commented
Title: Adding my own Community-id openid fails » HTML-based discovery not according to OpenID specification
Version: 6.19 » 7.x-dev
Status: Postponed (maintainer needs more info) » Active

This is a bug in core.

Community-id supports HTML based discovery. From the spec:

To use HTML-Based discovery, an HTML document MUST be available at the URL of the Claimed Identifier. Within the HEAD element of the document:

A LINK element MUST be included with attributes "rel" set to "openid2.provider" and "href" set to an OP Endpoint URL

A LINK element MAY be included with attributes "rel" set to "openid2.local_id" and "href" set to the end user's OP-Local Identifier

The protocol version when HTML discovery is performed is "http://specs.openid.net/auth/2.0/signon".

_openid_link_href however uses a simple preg_match and ONLY gives results on link elements where the rel attribute comes first.

So

<link rel="openid2.provider" href="http://example.com/openid/provider" />  - works
<link href="http://example.com/openid/provider" rel="openid2.provider" />  - doesn't work

And that 2nd —perfectly valid— form is what Community-ID returns.

Drupal 7 is also affected, moving to that version so it can be fixed there and backported.

heine’s picture

heine commented
Status: Active » Needs review
StatusFileSize
new do-955432-openid-html-delegation.patch820 bytes

Patch against 7.x-dev.

c960657’s picture

c960657 commented
Status: Needs review » Closed (duplicate)

This is a duplicate of #469590: Improve robustness of OpenID parsing for link 'rel' and meta 'http-equiv' attributes. I think the patch in comment #9 in that issue represents a more robust approach that parsing HTML using regular expressions.