OpenID provider does not redirect on OpenID auth

OpenID provider does not redirect on OpenID auth

Issue ID:3477
Issue Category:bug
Component:openid
Priority:normal
Status:active
Assigned:Unassigned
Version:1.0
Keywords:OpenID

When I'm not logged on to my statusnet instance, but try to do an OpenId login on a consumer site, it does redirect me to the statusnet login but not to the consumer after logging in. Instead it displays a message that it's just another openid server...

Updates

#1

I have this problem too. The problem seems to be in plugins/OpenID/openidserver.php or rather the process of passing through /main/login

This bug can be verified using the http://status.net/open-source issue tracker that we're posting this in. Steps to reproduce:
0. Make sure your OpenID is added to this issue tracker
1. Log out of your StatusNet account.
2. Go to this issue tracker and choose OpenID login
3. Fill in your StatusNet url that acts as OpenID server
4. Get redirected to "OpenID redirect" -> /main/login
5. Enter login details
6. Get "Just another OpenID provider"

In step 4 common_set_returnto() is set with $_SERVER['REQUEST_URI'], making the login-form know to return to '/main/openidserver'
In step 5->6 a POST is sent which logs you in, and then redirects you to '/main/openidserver'

Step 6 is however proof that openidserver.php does NOT process the initial OpenID authorization request properly. The problem stems in plugins/OpenID/openidserver.php on LINE 63:
$request = $this->oserver->decodeRequest();

decodeRequest will eventually (doesn't) get data from extlib/Auth/OpenID.php and Auth_OpenID::getQuery()

That function explains that data is retrieved from $_SERVER['QUERY_STRING'] merged with a weird implementation of $_POST. However no POST data exists because it was lost after submitting /main/login

...so how do we best save or transfer the OpenID authorization request to last past /main/login - and to make sure it ends up in the $this->oserver->decodeRequest() call?

Login or Register to modify this issue, or to receive updates by email.

You can also subscribe to the RSS feed for updates to this issue.