Defect #8399
closed
openid logins not working with 2.0 redirects
Added by Antoine Beaupré about 13 years ago.
Updated over 2 years ago.
Description
I am the maintainer of the Drupal.org OpenID Provider module. We are having interoperability problems when using POST redirections to login through openid on redmine sites.
We want to use POST redirections because it's part of the OpenID 2.0 standard spec and fixes interoperability problems with stackoverflow and dotnetauth relying parties.
The patch is here:
http://drupal.org/node/831162
I also filed this issue in the ruby library bugtracker:
https://github.com/openid/ruby-openid/issues/19
We're running the Debian backport on Lenny, with the 2.1.8 ruby library.
Thanks for any feedback
Files
Looks like the controller that open_id_redirect_url points to just needs to skip the checking of the authenticity token for that action since there is no point in this case.
- Category changed from Accounts / authentication to OpenID
Jeffrey Lee Jones: not sure how that could be done. Any ideas?
This is still broken. From what I can tell, Redmine needs a HTTP redirect, which is a 1.0 protocol, while it's actually implementing the 2.0 protocol.
So right now, I am making the decision of breaking the OpenID logins on redmine from Drupal, in favor of Stackoverflow and other standard implementations.
I would really appreciate feedback on how this could be fixed in Redmine, or in Drupal's openid_provider, if you guys think it's broken. As things stand, I believe the problem really is redmine.
I figured out how to disable the token check. You need to add
skip_before_filter :verify_authenticity_token
in the AccountController. Unforatunately, this disables CSRF attack protection on an important form. Furthermore, it still doesn't work: with this we just go back to the form, unmodified.
Alright, I confirm the fix works. I needed to fix both the Redmine and Drupal sides, as Redmine was refusing the login, not only because of the missing ticket, but also because Drupal was sending too much stuff.
I had to enable more debugging, otherwise Redmine would just send a blank page when the openid login would fail, without any explanation. I also had to pass down the errors from the ruby library... So the attached patch fixes all this.
This isn't quite perfect -- logging in with OpenID always redirects the user to the front page, no matter where you started.
- Status changed from New to Resolved
this seems to be fine without the patch in redmine 1.4.4.
- Status changed from Resolved to Closed
- Resolution set to Wont fix
The OpenID support has been dropped by #35755 for the upcoming Redmine 5.0.0.
Also available in: Atom
PDF